{"record":{"id":"b537db6f3225bd67","repo":"prestodb/presto","slug":"unsupported-principal-type","errorCode":null,"errorMessage":"Unsupported principal type: ","messagePattern":"Unsupported principal type: ","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"presto-hive-metastore/src/main/java/com/facebook/presto/hive/metastore/thrift/ThriftMetastoreUtil.java","lineNumber":220,"sourceCode":"    public static PrivilegeGrantInfo toMetastoreApiPrivilegeGrantInfo(HivePrivilegeInfo privilegeInfo)\n    {\n        return new PrivilegeGrantInfo(\n                privilegeInfo.getHivePrivilege().name().toLowerCase(Locale.ENGLISH),\n                0,\n                privilegeInfo.getGrantor().getName(),\n                fromPrestoPrincipalType(privilegeInfo.getGrantor().getType()),\n                privilegeInfo.isGrantOption());\n    }\n\n    public static org.apache.hadoop.hive.metastore.api.PrincipalType toMetastoreApiPrincipalType(PrincipalType principalType)\n    {\n        switch (principalType) {\n            case USER:\n                return org.apache.hadoop.hive.metastore.api.PrincipalType.USER;\n            case ROLE:\n                return org.apache.hadoop.hive.metastore.api.PrincipalType.ROLE;\n            default:\n                throw new IllegalArgumentException(\"Unsupported principal type: \" + principalType);\n        }\n    }\n\n    public static Stream<RoleGrant> listApplicableRoles(PrestoPrincipal principal, Function<PrestoPrincipal, Set<RoleGrant>> listRoleGrants)\n    {\n        Queue<PrestoPrincipal> queue = new ArrayDeque<>();\n        queue.add(principal);\n        Queue<RoleGrant> output = new ArrayDeque<>();\n        Set<RoleGrant> seenRoles = new HashSet<>();\n        return Streams.stream(new AbstractIterator<RoleGrant>()\n        {\n            @Override\n            protected RoleGrant computeNext()\n            {\n                if (!output.isEmpty()) {\n                    return output.remove();\n                }\n                if (queue.isEmpty()) {","sourceCodeStart":202,"sourceCodeEnd":238,"githubUrl":"https://github.com/prestodb/presto/blob/55bb57d202de3b926896fa966c2c4a44c779634e/presto-hive-metastore/src/main/java/com/facebook/presto/hive/metastore/thrift/ThriftMetastoreUtil.java#L202-L238","documentation":"ThriftMetastoreUtil.toMetastoreApiPrincipalType maps Presto's PrincipalType (USER, ROLE) to the Hive metastore API PrincipalType. Presto only defines USER and ROLE; the default branch throws IllegalArgumentException(\"Unsupported principal type: \" + principalType) because there is no Hive equivalent for the value (typically GROUP).","triggerScenarios":"Calling toMetastoreApiDatabase (or other toMetastoreApi* callers) with a PrestoPrincipal whose type is not USER or ROLE — e.g. a PrestoPrincipal of type GROUP constructed from a table-grant owner or authorization identity, passed into metadata APIs that convert it for the metastore.","commonSituations":"Hive connector operating on a table whose owner/privileges were recorded as a GROUP principal (possible when Hive-native authorization stored group grants); custom connectors or code building PrestoPrincipal(GROUP, ...) and calling metastore mapping; session/function authorization identities resolving to GROUP.","solutions":["Find the PrestoPrincipal being mapped and change its type to USER or ROLE before invoking the metastore call.","If a table owner is stored as GROUP (legacy Hive-managed privilege), migrate the ownership/privileges to a USER or ROLE principal (ALTER TABLE ... SET / Hive-side re-grants).","Extend the switch (in a fork) to map GROUP to org.apache.hadoop.hive.metastore.api.PrincipalType.GROUP if the target metastore supports it.","Audit where principals originate (authorization identity providers) and reject GROUP principals at the connector boundary."],"exampleFix":"// before\nPrestoPrincipal owner = new PrestoPrincipal(GROUP, groupName);\nmetastore.createDatabase(..., toMetastoreApiDatabase(owner, ...));\n// after\nPrestoPrincipal owner = new PrestoPrincipal(USER, userName);\nif (owner.getType() != USER && owner.getType() != ROLE) {\n    throw new IllegalArgumentException(\"Principal must be USER or ROLE: \" + owner.getType());\n}\nmetastore.createDatabase(..., toMetastoreApiDatabase(owner, ...));","handlingStrategy":"type-guard","validationCode":"// validate principal type before any metastore mapping call\npublic static void requireSupportedPrincipal(PrestoPrincipal principal) {\n    checkArgument(principal.getType() == PrincipalType.USER\n            || principal.getType() == PrincipalType.ROLE,\n        \"Unsupported principal type for metastore: %s\", principal.getType());\n}","typeGuard":"public static boolean isMetastoreSupportedPrincipal(PrestoPrincipal principal) {\n    return principal.getType() == PrincipalType.USER\n        || principal.getType() == PrincipalType.ROLE;\n}\n// usage: if (isMetastoreSupportedPrincipal(principal)) { ... } else { fail fast with clear message }","tryCatchPattern":"try {\n    toMetastoreApiDatabase(principal, ...);\n}\ncatch (IllegalArgumentException e) {\n    if (e.getMessage().startsWith(\"Unsupported principal type\")) {\n        throw new PrestoException(NOT_SUPPORTED, \"GROUP principals are not supported by the Hive metastore mapping\", e);\n    }\n    throw e;\n}","preventionTips":["Never construct PrestoPrincipal with GROUP for Hive connector metadata calls.","Migrate legacy GROUP-based table owners/privileges to USER or ROLE principals.","Validate principal types at API boundaries before reaching metastore mapping utilities.","Add tests covering all PrincipalType values against toMetastoreApi* helpers."],"tags":["hive-metastore","principal-type","mapping","illegal-argument"],"backgroundTag":"unsupported-enum-value","analyzedSha":"55bb57d202de3b926896fa966c2c4a44c779634e","analyzedAt":"2026-09-04T12:50:26.162Z","contentChangedAt":"2026-09-04T12:50:26.162Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}