{"record":{"id":"988dc170bc78e7a7","repo":"prestodb/presto","slug":"cannot-set-catalog-session-property-s-s-s","errorCode":null,"errorMessage":"Cannot set catalog session property %s.%s%s","messagePattern":"Cannot set catalog session property (.+?)\\.(.+?)(.+?)","errorType":"exception","errorClass":"AccessDeniedException","httpStatus":null,"severity":"error","filePath":"presto-spi/src/main/java/com/facebook/presto/spi/security/AccessDeniedException.java","lineNumber":367,"sourceCode":"\n    public static void denySetSystemSessionProperty(String propertyName)\n    {\n        denySetSystemSessionProperty(propertyName, null);\n    }\n\n    public static void denySetSystemSessionProperty(String propertyName, String extraInfo)\n    {\n        throw new AccessDeniedException(format(\"Cannot set system session property %s%s\", propertyName, formatExtraInfo(extraInfo)));\n    }\n\n    public static void denySetCatalogSessionProperty(String catalogName, String propertyName)\n    {\n        denySetCatalogSessionProperty(catalogName, propertyName, null);\n    }\n\n    public static void denySetCatalogSessionProperty(String catalogName, String propertyName, String extraInfo)\n    {\n        throw new AccessDeniedException(format(\"Cannot set catalog session property %s.%s%s\", catalogName, propertyName, formatExtraInfo(extraInfo)));\n    }\n\n    public static void denySetCatalogSessionProperty(String propertyName)\n    {\n        throw new AccessDeniedException(format(\"Cannot set catalog session property %s\", propertyName));\n    }\n\n    public static void denySelectColumns(String tableName, Collection<String> columnNames)\n    {\n        denySelectColumns(tableName, columnNames, null);\n    }\n\n    public static void denySelectColumns(String tableName, Collection<String> columnNames, String extraInfo)\n    {\n        throw new AccessDeniedException(format(\"Cannot select from columns %s in table or view %s%s\", columnNames.stream().sorted().collect(Collectors.toList()), tableName, formatExtraInfo(extraInfo)));\n    }\n\n    public static void denyCallProcedure(String procedureName)","sourceCodeStart":349,"sourceCodeEnd":385,"githubUrl":"https://github.com/prestodb/presto/blob/55bb57d202de3b926896fa966c2c4a44c779634e/presto-spi/src/main/java/com/facebook/presto/spi/security/AccessDeniedException.java#L349-L385","documentation":"Thrown by denySetCatalogSessionProperty(catalog, property[, extraInfo]) when setting a connector (catalog-level) session property is denied by checkCanSetCatalogSessionProperty. Connectors expose properties like hive.bucket-execution or memory settings; deployments often restrict who may change them. The extraInfo suffix conveys an optional denial reason from the authorizer.","triggerScenarios":"Executing 'SET SESSION <catalog>.<property> = value' or supplying the catalog property via JDBC/CLI when the access control denies the user for that catalogName/propertyName pair.","commonSituations":"Tuning Hive/ICEBERG connector properties in a shared cluster where only service accounts may; CI jobs setting properties hard-coded from older setups; connectors whose properties became governed after an upgrade.","solutions":["Drop the catalog property override and rely on connector/catalog defaults.","Have the operator whitelist the property (and your role) in the access control rules.","Confirm the property belongs to the catalog you targeted; use the correct catalog prefix.","Move the tuning into the catalog's properties file (etc/catalog/*.properties) managed by ops."],"exampleFix":"// before (denied)\nSET SESSION hive.max_split_size = '1GB';\n// after: ask ops to set it server-side\n// etc/catalog/hive.properties:\n//   hive.max-split-size=1GB","handlingStrategy":"validation","validationCode":"// Pre-check against the connector's governed property list\nif (!isCatalogPropertyAllowedForUser(catalogName, propertyName, currentUser)) {\n    skipSessionPropertyOverride(catalogName, propertyName);\n}","typeGuard":null,"tryCatchPattern":"try {\n    stmt.execute(String.format(\"SET SESSION %s.%s = '%s'\", catalog, prop, value));\n} catch (AccessDeniedException e) {\n    log.warn(\"Catalog property {}.{} denied: {}\", catalog, prop, e.getMessage());\n}","preventionTips":["Move connector tuning into etc/catalog/<catalog>.properties owned by ops.","Whitelist only the properties teams truly need in access control rules.","Re-validate property allowlists after connector upgrades."],"tags":["security","session-properties","access-control","connector"],"backgroundTag":"access-denied-authorization","analyzedSha":"55bb57d202de3b926896fa966c2c4a44c779634e","analyzedAt":"2026-09-04T12:50:26.162Z","contentChangedAt":"2026-09-04T12:50:26.162Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}