{"record":{"id":"b265686c4cf8e2cf","repo":"apache/hadoop","slug":"user-pc-getuser-does-not-belong-to","errorCode":null,"errorMessage":"\"User \" + pc.getUser() + \" does not belong to \" + group","messagePattern":"\"User \" \\+ pc\\.getUser\\(\\) \\+ \" does not belong to \" \\+ group","errorType":"exception","errorClass":"AccessControlException","httpStatus":null,"severity":"error","filePath":"hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/namenode/FSDirAttrOp.java","lineNumber":101,"sourceCode":"      iip = fsd.resolvePath(pc, src, DirOp.WRITE);\n      fsd.checkOwner(pc, iip);\n      // At this point, the user must be either owner or super user.\n      // superuser: can change owner to a different user,\n      // change owner group to any group\n      // owner: can't change owner to a different user but can change owner\n      // group to different group that the user belongs to.\n      if ((username != null && !pc.getUser().equals(username)) ||\n          (group != null && !pc.isMemberOfGroup(group))) {\n        try {\n          // check if the user is superuser\n          pc.checkSuperuserPrivilege(iip.getPath());\n        } catch (AccessControlException e) {\n          if (username != null && !pc.getUser().equals(username)) {\n            throw new AccessControlException(\"User \" + pc.getUser()\n                + \" is not a super user (non-super user cannot change owner).\");\n          }\n          if (group != null && !pc.isMemberOfGroup(group)) {\n            throw new AccessControlException(\n                \"User \" + pc.getUser() + \" does not belong to \" + group);\n          }\n        }\n      }\n      changed = unprotectedSetOwner(fsd, iip, username, group);\n    } finally {\n      fsd.writeUnlock();\n    }\n    if (changed) {\n      fsd.getEditLog().logSetOwner(iip.getPath(), username, group);\n    }\n    return fsd.getAuditFileInfo(iip);\n  }\n\n  static FileStatus setTimes(\n      FSDirectory fsd, FSPermissionChecker pc, String src, long mtime,\n      long atime) throws IOException {\n    INodesInPath iip;","sourceCodeStart":83,"sourceCodeEnd":119,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/namenode/FSDirAttrOp.java#L83-L119","documentation":"A non-superuser owner may change a file's group only to a group they belong to; when the requested group is not in the caller's group set and the superuser check fails, setOwner throws AccessControlException 'User X does not belong to Y'. Group membership is resolved by the NameNode's group mapping service (LDAP/AD/static), not the client.","triggerScenarios":"DistributedFileSystem.setOwner(path, null, group) or 'hdfs dfs -chgrp <group> <path>' by the file owner where the group is absent from their group list as computed by the NN-side group mapping.","commonSituations":"Users expecting membership in newly created project groups before LDAP/AD provisioning propagates; stale NameNode group-mapping cache; AD environments where group names differ by case or domain prefix from what users pass.","solutions":["Have the superuser (or a member of the target group) perform the chgrp.","Fix membership at the source (LDAP/AD) and refresh the NameNode's view: 'hdfs dfsadmin -refreshUserToGroupsMappings' plus the dfs.namenode.groups.cache.secs timeout.","Verify what the cluster thinks the caller's groups are with 'hdfs groups <user>' and use exactly one of those names."],"exampleFix":"// before\nfs.setOwner(path, null, \"analytics\"); // may throw if user not in group\n\n// after: check membership first\nUserGroupInformation ugi = UserGroupInformation.getCurrentUser();\nif (!Arrays.asList(ugi.getGroupNames()).contains(\"analytics\")) {\n  throw new AccessControlException(ugi.getUserName() + \" not in analytics; ask admin or refresh groups\");\n}\nfs.setOwner(path, null, \"analytics\");","handlingStrategy":"validation","validationCode":"UserGroupInformation ugi = UserGroupInformation.getCurrentUser();\nif (group != null && !Arrays.asList(ugi.getGroupNames()).contains(group)) {\n  throw new AccessControlException(ugi.getUserName()\n      + \" is not a member of \" + group + \"; run as superuser or fix group mapping\");\n}\nfs.setOwner(path, null, group);","typeGuard":null,"tryCatchPattern":"try {\n  fs.setOwner(path, null, group);\n} catch (AccessControlException e) {\n  if (e.getMessage().contains(\"does not belong to\")) {\n    // verify with 'hdfs groups <user>'; ask superuser to chgrp or refresh group mapping\n  }\n}","preventionTips":["Confirm membership the way the NameNode sees it: 'hdfs groups <user>'.","After LDAP/AD changes, run 'hdfs dfsadmin -refreshUserToGroupsMappings' and mind the groups cache TTL."],"tags":["hdfs","permissions","groups","access-control"],"backgroundTag":"permission-denied-group-membership","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}