{"record":{"id":"a62d8aa7dab6769a","repo":"prestodb/presto","slug":"missing-role-a62d8a","errorCode":"MISSING_ROLE","errorMessage":"Role '%s' does not exist","messagePattern":"Role '(.+?)' does not exist","errorType":"error_code","errorClass":"SemanticException","httpStatus":null,"severity":"error","filePath":"presto-main-base/src/main/java/com/facebook/presto/execution/GrantRolesTask.java","lineNumber":74,"sourceCode":"                .collect(toImmutableSet());\n        boolean withAdminOption = statement.isWithAdminOption();\n        Optional<PrestoPrincipal> grantor = statement.getGrantor().map(specification -> createPrincipal(session, specification));\n        String catalog = createCatalogName(session, statement);\n\n        Set<String> availableRoles = metadata.listRoles(session, catalog);\n        Set<String> specifiedRoles = new LinkedHashSet<>();\n        specifiedRoles.addAll(roles);\n        grantees.stream()\n                .filter(principal -> principal.getType() == ROLE)\n                .map(PrestoPrincipal::getName)\n                .forEach(specifiedRoles::add);\n        if (grantor.isPresent() && grantor.get().getType() == ROLE) {\n            specifiedRoles.add(grantor.get().getName());\n        }\n\n        for (String role : specifiedRoles) {\n            if (!availableRoles.contains(role)) {\n                throw new SemanticException(MISSING_ROLE, statement, \"Role '%s' does not exist\", role);\n            }\n        }\n\n        accessControl.checkCanGrantRoles(session.getRequiredTransactionId(), session.getIdentity(), session.getAccessControlContext(), roles, grantees, withAdminOption, grantor, catalog);\n        metadata.grantRoles(session, roles, grantees, withAdminOption, grantor, catalog);\n\n        return immediateFuture(null);\n    }\n}\n","sourceCodeStart":56,"sourceCodeEnd":84,"githubUrl":"https://github.com/prestodb/presto/blob/55bb57d202de3b926896fa966c2c4a44c779634e/presto-main-base/src/main/java/com/facebook/presto/execution/GrantRolesTask.java#L56-L84","documentation":"Thrown by GrantRolesTask when a role being granted (or the specified grantor, when the grantor is of type ROLE) is not present in availableRoles for the catalog. Presto validates every specified role against accessControl.getAvailableRoles before calling metadata.grantRoles.","triggerScenarios":"Executing `GRANT role TO user` (or `GRANTED BY some_role`) where the role string is not in the catalog's available role set, raising SemanticException(MISSING_ROLE).","commonSituations":"Role never created (missing CREATE ROLE step); role created in a different catalog; typo in role name; grantor clause referencing a role the connector does not define.","solutions":["Create the role first with CREATE ROLE <role> IN <catalog>","Verify existing roles via SELECT * FROM <catalog>.information_schema.roles or SHOW ROLES IN <catalog>","Correct the role name or remove the GRANTED BY clause if the grantor role does not exist"],"exampleFix":"// before\nGRANT analyst_role TO USER bob;\n// after\nCREATE ROLE analyst_role; -- in the target catalog\nGRANT analyst_role TO USER bob;","handlingStrategy":"validation","validationCode":"-- verify roles exist before GRANT\nSELECT role_name FROM <catalog>.information_schema.roles\nWHERE role_name IN ('analyst_role', 'grantor_role');","typeGuard":null,"tryCatchPattern":"try { grantRoles(...); } catch (SemanticException e) { if (e.getCode() == SemanticErrorCode.MISSING_ROLE) { /* create role then retry once */ } else { throw e; } }","preventionTips":["Run CREATE ROLE as part of provisioning before GRANT scripts","List roles with SHOW ROLES IN <catalog> to validate names","Avoid GRANTED BY clauses referencing roles not defined in the connector"],"tags":["presto","sql","security","role","semantic-error"],"backgroundTag":"role-does-not-exist","analyzedSha":"55bb57d202de3b926896fa966c2c4a44c779634e","analyzedAt":"2026-09-04T12:50:26.162Z","contentChangedAt":"2026-09-04T12:50:26.162Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}