{"record":{"id":"8aa8d613a5ae6fd5","repo":"prestodb/presto","slug":"cannot-show-current-roles-from-catalog-s","errorCode":null,"errorMessage":"Cannot show current roles from catalog %s","messagePattern":"Cannot show current roles from catalog (.+?)","errorType":"exception","errorClass":"AccessDeniedException","httpStatus":null,"severity":"error","filePath":"presto-spi/src/main/java/com/facebook/presto/spi/security/AccessDeniedException.java","lineNumber":342,"sourceCode":"\n    public static void denyRevokeTablePrivilege(String privilege, String tableName)\n    {\n        denyRevokeTablePrivilege(privilege, tableName, null);\n    }\n\n    public static void denyRevokeTablePrivilege(String privilege, String tableName, String extraInfo)\n    {\n        throw new AccessDeniedException(format(\"Cannot revoke privilege %s on table %s%s\", privilege, tableName, formatExtraInfo(extraInfo)));\n    }\n\n    public static void denyShowRoles(String catalogName)\n    {\n        throw new AccessDeniedException(format(\"Cannot show roles from catalog %s\", catalogName));\n    }\n\n    public static void denyShowCurrentRoles(String catalogName)\n    {\n        throw new AccessDeniedException(format(\"Cannot show current roles from catalog %s\", catalogName));\n    }\n\n    public static void denyShowRoleGrants(String catalogName)\n    {\n        throw new AccessDeniedException(format(\"Cannot show role grants from catalog %s\", catalogName));\n    }\n\n    public static void denySetSystemSessionProperty(String propertyName)\n    {\n        denySetSystemSessionProperty(propertyName, null);\n    }\n\n    public static void denySetSystemSessionProperty(String propertyName, String extraInfo)\n    {\n        throw new AccessDeniedException(format(\"Cannot set system session property %s%s\", propertyName, formatExtraInfo(extraInfo)));\n    }\n\n    public static void denySetCatalogSessionProperty(String catalogName, String propertyName)","sourceCodeStart":324,"sourceCodeEnd":360,"githubUrl":"https://github.com/prestodb/presto/blob/55bb57d202de3b926896fa966c2c4a44c779634e/presto-spi/src/main/java/com/facebook/presto/spi/security/AccessDeniedException.java#L324-L360","documentation":"Thrown when SHOW CURRENT ROLES FROM <catalog> is denied for the current identity. denyShowCurrentRoles is called from checkCanShowCurrentRoles in the access control layer. It reports the roles active for the session and is gated separately from general role listing.","triggerScenarios":"SHOW CURRENT ROLES FROM catalog_name (optionally FOR USER x) where checkCanShowCurrentRoles is denied; querying another user's current roles is often denied even when viewing your own is allowed.","commonSituations":"Admins checking effective roles per user in role-enabled connectors (Hive/Iceberg); security configs granting show-roles but not show-current-roles; session role activation confusion.","solutions":["Grant show-current-roles permission in the access control configuration for the user/role","Have an admin run the statement on the user's behalf","Check your own current roles (without FOR USER) if allowed by policy"],"exampleFix":"// before\nSHOW CURRENT ROLES FROM hive FOR USER bob; -- AccessDeniedException\n// after (in access-control json)\n// { \"showCurrentRoles\": { \"allow\": true } } for admin role\nSHOW CURRENT ROLES FROM hive; -- as admin","handlingStrategy":"try-catch","validationCode":"boolean canShowCurrentRoles = accessControlConfig.allows(\"showCurrentRoles\", user, catalog);","typeGuard":null,"tryCatchPattern":"try {\n    return query(\"SHOW CURRENT ROLES FROM \" + catalog);\n} catch (AccessDeniedException e) {\n    log.warn(\"Current-role listing denied in catalog {}: {}\", catalog, e.getMessage());\n    return List.of();\n}","preventionTips":["Grant show-current-roles alongside show-roles when users need both","Avoid SHOW CURRENT ROLES FOR USER <other> unless policy allows admin introspection","Verify with SET ROLE which roles are active before debugging access denials"],"tags":["security","authorization","roles","metadata"],"backgroundTag":"access-denied","analyzedSha":"55bb57d202de3b926896fa966c2c4a44c779634e","analyzedAt":"2026-09-04T12:50:26.162Z","contentChangedAt":"2026-09-04T12:50:26.162Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}