{"record":{"id":"8e28cfb5e43d0ca9","repo":"prestodb/presto","slug":"cannot-set-catalog-session-property","errorCode":null,"errorMessage":"Cannot set catalog session property: ","messagePattern":"Cannot set catalog session property: ","errorType":"exception","errorClass":"AccessDeniedException","httpStatus":null,"severity":"warning","filePath":"presto-plugin-toolkit/src/main/java/com/facebook/presto/plugin/base/security/FileBasedAccessControl.java","lineNumber":494,"sourceCode":"            }\n        }\n        return false;\n    }\n\n    private boolean isDatabaseOwner(ConnectorIdentity identity, String schemaName)\n    {\n        for (SchemaAccessControlRule rule : schemaRules) {\n            Optional<Boolean> owner = rule.match(identity.getUser(), schemaName);\n            if (owner.isPresent()) {\n                return owner.get();\n            }\n        }\n        return false;\n    }\n\n    private static void denySetSessionProperty(String propertyName)\n    {\n        throw new AccessDeniedException(\"Cannot set catalog session property: \" + propertyName);\n    }\n}\n","sourceCodeStart":476,"sourceCodeEnd":497,"githubUrl":"https://github.com/prestodb/presto/blob/55bb57d202de3b926896fa966c2c4a44c779634e/presto-plugin-toolkit/src/main/java/com/facebook/presto/plugin/base/security/FileBasedAccessControl.java#L476-L497","documentation":"FileBasedAccessControl denies the operation outright: when the access-control rules do not grant a principal permission to set the given catalog session property, denySetSessionProperty throws AccessDeniedException, which Presto surfaces as an access-denied failure for the query/SET SESSION call.","triggerScenarios":"A user or client issues SET SESSION catalog.property=value (or via JDBC connection properties) for a catalog session property not explicitly allowed in the file-based access control rules; checkCanSetCatalogSessionProperty resolves to deny.","commonSituations":"BI/JDBC tools silently setting catalog session properties (e.g. Hive bucket execution, Iceberg formats) that the security.json never whitelisted; adding a new catalog without updating access-control rules; restrictive 'catalog.session-property' rules with wrong case or wrong catalog name.","solutions":["Add an allow rule for the specific catalog session property in the file-based access control JSON (catalog.session-property rules)","Ensure catalog name and property name in the rule match exactly (case-sensitive)","If the property should be open, add a wildcard allow rule for catalog session properties on that catalog","As a stopgap, configure the property at the catalog/session level server-side so clients need not set it"],"exampleFix":"// before (access-control.json)\n{\n  \"catalogs\": [{ \"user\": \"alice\", \"catalog\": \"hive\", \"privileges\": [\"SELECT\"] }]\n}\n// after\n{\n  \"catalogs\": [{ \"user\": \"alice\", \"catalog\": \"hive\", \"privileges\": [\"SELECT\"] }],\n  \"catalogSessionProperties\": [\n    { \"user\": \"alice\", \"catalog\": \"hive\", \"property\": \"bucket_execution_enabled\", \"allow\": true }\n  ]\n}","handlingStrategy":"validation","validationCode":"# before granting users/clients, check the rules file covers the property\njq '.catalogSessionProperties[]? | select(.catalog==\"hive\" and .property==\"my_property\")' security.json","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Mirror every client-set session property in the access-control rules","Test new catalogs with the real security.json before rollout","Avoid tools silently setting catalog session properties; set them server-side instead","Keep rule names case-exact with catalog/property names"],"tags":["presto","security","access-control","authorization"],"backgroundTag":"access-denied-session-property","analyzedSha":"55bb57d202de3b926896fa966c2c4a44c779634e","analyzedAt":"2026-09-04T12:50:26.162Z","contentChangedAt":"2026-09-04T12:50:26.162Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}