{"record":{"id":"9463c6949fcabb98","repo":"apache/hadoop","slug":"setacl-operation-is-only-supported-on-hns-enabled","errorCode":null,"errorMessage":"SetAcl operation is only supported on HNS enabled Accounts.","messagePattern":"SetAcl operation is only supported on HNS enabled Accounts\\.","errorType":"exception","errorClass":"UnsupportedOperationException","httpStatus":null,"severity":"error","filePath":"hadoop-tools/hadoop-azure/src/main/java/org/apache/hadoop/fs/azurebfs/services/AbfsBlobClient.java","lineNumber":1457,"sourceCode":"        \"SetPermission operation is only supported on HNS enabled Accounts.\");\n  }\n\n  /**\n   * Set the ACL of the file or directory.\n   * Not supported for HNS-Disabled Accounts.\n   * @param path on which ACL has to be set.\n   * @param aclSpecString to be set.\n   * @param eTag to specify conditional headers. Set only if etag matches.\n   * @param tracingContext for tracing the server calls.\n   * @return exception as this operation is not supported on Blob Endpoint.\n   * @throws UnsupportedOperationException always.\n   */\n  @Override\n  public AbfsRestOperation setAcl(final String path,\n      final String aclSpecString,\n      final String eTag,\n      final TracingContext tracingContext) throws AzureBlobFileSystemException {\n    throw new UnsupportedOperationException(\n        \"SetAcl operation is only supported on HNS enabled Accounts.\");\n  }\n\n  /**\n   * Get the ACL of the file or directory.\n   * Not supported for HNS-Disabled Accounts.\n   * @param path of which properties have to be fetched.\n   * @param useUPN whether to use UPN with rest operation.\n   * @param tracingContext for tracing the server calls.\n   * @return exception as this operation is not supported on Blob Endpoint.\n   * @throws UnsupportedOperationException always.\n   */\n  @Override\n  public AbfsRestOperation getAclStatus(final String path,\n      final boolean useUPN,\n      TracingContext tracingContext) throws AzureBlobFileSystemException {\n    throw new UnsupportedOperationException(\n        \"GetAclStatus operation is only supported on HNS enabled Accounts.\");","sourceCodeStart":1439,"sourceCodeEnd":1475,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-tools/hadoop-azure/src/main/java/org/apache/hadoop/fs/azurebfs/services/AbfsBlobClient.java#L1439-L1475","documentation":"On accounts without Hierarchical Namespace, AbfsBlobClient.setAcl is a stub that unconditionally throws UnsupportedOperationException('SetAcl operation is only supported on HNS enabled Accounts.'). POSIX ACLs (named user/group entries, masks, defaults) only exist on ADLS Gen2 HNS paths, so the driver rejects the call client-side before any REST request.","triggerScenarios":"Calling fs.setAcl(path, entries) against an abfs:// filesystem whose underlying storage account has hierarchical namespace disabled — e.g. ACL migration scripts, Ranger-driven ACL enforcement, distcp preserving ACLs.","commonSituations":"ACL sync tooling built for HDFS pointed at non-HNS ADLS; security-hardening playbooks that blanket-apply ACLs across all mounted filesystems; accounts onboarded before HNS was enabled.","solutions":["Enable Hierarchical Namespace on the account or use an HNS account for ACL-managed data","Skip ACL application for non-HNS filesystems in your tooling (feature-detect first)","Use Azure RBAC / container-level access policies for access control on flat-namespace accounts"],"exampleFix":"// before\nfs.setAcl(path, entries);\n\n// after\nif (isHnsAccount(fs)) {\n  fs.setAcl(path, entries);\n}","handlingStrategy":"validation","validationCode":"if (isHnsAccount(fs)) {\n  fs.setAcl(path, entries);\n}","typeGuard":"private static boolean supportsAcls(FileSystem fs) {\n  return !(fs instanceof AzureBlobFileSystem)\n      || fs.getConf().getBoolean(\"fs.azure.account.hns.enabled\", false);\n}","tryCatchPattern":"try {\n  fs.setAcl(path, entries);\n} catch (UnsupportedOperationException e) {\n  // ACLs require HNS: apply Azure-level access policy instead\n}","preventionTips":["Feature-detect HNS before running ACL management jobs","Keep ACL sync tooling scoped to HNS mounts","Do not port HDFS ACL hardening scripts verbatim to blob endpoints"],"tags":["azure","abfs","unsupported-operation","hns","acl"],"backgroundTag":"unsupported-operation","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-23T01:17:44.959Z"}