{"record":{"id":"a8782df7e112faed","repo":"apache/hadoop","slug":"user-s-is-not-authorized-to-perform-s-on-key","errorCode":null,"errorMessage":"User [%s] is not authorized to perform [%s] on key with ACL name [%s]!!","messagePattern":"User \\[(.+?)\\] is not authorized to perform \\[(.+?)\\] on key with ACL name \\[(.+?)\\]!!","errorType":"exception","errorClass":"AuthorizationException","httpStatus":403,"severity":"error","filePath":"hadoop-common-project/hadoop-kms/src/main/java/org/apache/hadoop/crypto/key/kms/server/KeyAuthorizationKeyProvider.java","lineNumber":148,"sourceCode":"      success = acls.isACLPresent(aclName, KeyOpType.MANAGEMENT) &&\n          (acls.hasAccessToKey(aclName, ugi, KeyOpType.MANAGEMENT)\n          || acls.hasAccessToKey(aclName, ugi, KeyOpType.ALL));\n    }\n    if (!success)\n      throw new AuthorizationException(String.format(\"User [%s] is not\"\n          + \" authorized to create key !!\", ugi.getShortUserName()));\n  }\n\n  private void checkAccess(String aclName, UserGroupInformation ugi,\n      KeyOpType opType) throws AuthorizationException {\n    Preconditions.checkNotNull(aclName, \"Key ACL name cannot be null\");\n    Preconditions.checkNotNull(ugi, \"UserGroupInformation cannot be null\");\n    if (acls.isACLPresent(aclName, opType) &&\n        (acls.hasAccessToKey(aclName, ugi, opType)\n            || acls.hasAccessToKey(aclName, ugi, KeyOpType.ALL))) {\n      return;\n    } else {\n      throw new AuthorizationException(String.format(\"User [%s] is not\"\n          + \" authorized to perform [%s] on key with ACL name [%s]!!\",\n          ugi.getShortUserName(), opType, aclName));\n    }\n  }\n\n  @Override\n  public KeyVersion createKey(String name, Options options)\n      throws NoSuchAlgorithmException, IOException {\n    writeLock.lock();\n    try {\n      authorizeCreateKey(name, options, getUser());\n      return provider.createKey(name, options);\n    } finally {\n      writeLock.unlock();\n    }\n  }\n\n  @Override","sourceCodeStart":130,"sourceCodeEnd":166,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-kms/src/main/java/org/apache/hadoop/crypto/key/kms/server/KeyAuthorizationKeyProvider.java#L130-L166","documentation":"KeyAuthorizationKeyProvider.checkAccess (line 148) guards every key operation (READ, GENERATE_EEK, DECRYPT_EEK, ROLLOVER, DECRYPT, ENCRYPT, ...). Access requires an existing key ACL entry key.acl.<aclname>.<OP> (or key.acl.<aclname>.ALL) in kms-acls.xml that contains the caller. Otherwise it throws AuthorizationException 'User [<u>] is not authorized to perform [<op>] on key with ACL name [<acl>]!!' -> HTTP 403.","triggerScenarios":"Operations like rolloverKey, generateEncryptedKey, decryptEncryptedKey, getKeyVersion on a key whose ACL name has no entry for that specific op type — e.g. a user allowed GENERATE_EEK but issuing DECRYPT_EEK, or decrypting EEKs of a key with only key.acl.<name>.READ defined.","commonSituations":"Zone/crypto service accounts missing DECRYPT_EEK on an encryption-zone key; after key ACL refactors an op-specific entry was dropped; clients assuming READ covers EEK operations (it does not: EEK ops need GENERATE_EEK/DECRYPT_EEK entries).","solutions":["Add the missing per-op entry key.acl.<aclname>.<OP> (e.g. key.acl.mykey.DECRYPT_EEK) with the user/group, or grant key.acl.<aclname>.ALL","Match the ACL name exactly: it is the key's key.acl.name attribute, which can differ from the key name","Wait for kms-acls.xml hot reload (or restart KMS) and retry; verify with the KMS audit log which op was denied"],"exampleFix":"<!-- kms-acls.xml -->\n<property>\n  <name>key.acl.mykey.DECRYPT_EEK</name>\n  <value>hdfs,hive</value>\n</property>","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try { kpExt.generateEncryptedKey(name); } catch (AuthorizationException e) { /* 403: add user to key.acl.<name>.GENERATE_EEK (or .ALL) */ log.warn(\"key ACL denied\", e); }","preventionTips":["Grant per-op key ACLs for every operation each service account performs (GENERATE_EEK, DECRYPT_EEK, ROLLOVER, ...)","Review key ACL coverage when onboarding new HDFS encryption zones","Treat READ as insufficient for EEK flows by design"],"tags":["hadoop-kms","authorization","http-403","key-acl","security","key-management"],"backgroundTag":"authorization-denied-acl","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}