{"record":{"id":"c0cb9d995dd4e4c0","repo":"juicedata/juicefs","slug":"permission-denied","errorCode":null,"errorMessage":"permission denied","messagePattern":"permission denied","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"sdk/java/src/main/java/io/juicefs/JuiceFileSystemImpl.java","lineNumber":2432,"sourceCode":"            realUser);\n    identifier.setIssueDate(issueDate);\n    identifier.setMaxDate(maxDate);\n    identifier.setMasterKeyId(id);\n\n    return new Token<>(\n        identifier.getBytes(),\n        pwd,\n        identifier.getKind(),\n        new Text(getCanonicalServiceName()));\n  }\n\n  public long renewToken(Token<?> token) throws IOException {\n    AbstractDelegationTokenIdentifier identifier = (AbstractDelegationTokenIdentifier) token.decodeIdentifier();\n    int id = identifier.getMasterKeyId();\n    String pwd = new String(token.getPassword(), StandardCharsets.UTF_8);\n    long r = lib.jfs_renew_token(handle, id, pwd);\n    if (r == EACCESS) {\n      throw new IOException(\"permission denied\");\n    }\n    if (r < 0) {\n      throw new IOException(String.format(\"renew token failed, return code %d\", r));\n    }\n    return r * 1000;\n  }\n\n  public void cancelToken(Token<?> token) throws IOException {\n    AbstractDelegationTokenIdentifier identifier = (AbstractDelegationTokenIdentifier) token.decodeIdentifier();\n    int id = identifier.getMasterKeyId();\n    String pwd = new String(token.getPassword(), StandardCharsets.UTF_8);\n    int r = lib.jfs_cancel_token(handle, id, pwd);\n    if (r == EACCESS) {\n      throw new IOException(\"permission denied\");\n    }\n    if (r < 0) {\n      throw new IOException(String.format(\"cancel token failed, return code %d\", r));\n    }","sourceCodeStart":2414,"sourceCodeEnd":2450,"githubUrl":"https://github.com/juicedata/juicefs/blob/c9a67b23e8e08ec23ec331aa6f1675e2319e921c/sdk/java/src/main/java/io/juicefs/JuiceFileSystemImpl.java#L2414-L2450","documentation":"Generic permission-denied signal in the delegation token lifecycle: when jfs_renew_token or jfs_cancel_token returns EACCESS the caller is not the token owner or renewer, so the metadata engine rejects the operation.","triggerScenarios":"Thrown at sdk/java/src/main/java/io/juicefs/JuiceFileSystemImpl.java:2432 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Renew or cancel the token using the same user (or configured renewer) that obtained it","Verify token delegation settings in the volume format"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"c9a67b23e8e08ec23ec331aa6f1675e2319e921c","analyzedAt":"2026-09-06T17:55:48.476Z","contentChangedAt":"2026-09-06T17:55:48.476Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}