{"record":{"id":"c36801a0c0361bad","repo":"prestodb/presto","slug":"hive-connector-does-not-support-with-admin-stateme","errorCode":null,"errorMessage":"Hive Connector does not support WITH ADMIN statement","messagePattern":"Hive Connector does not support WITH ADMIN statement","errorType":"exception","errorClass":"AccessDeniedException","httpStatus":null,"severity":"error","filePath":"presto-hive/src/main/java/com/facebook/presto/hive/security/SqlStandardAccessControl.java","lineNumber":504,"sourceCode":"    @Override\n    public void checkCanRevokeTablePrivilege(ConnectorTransactionHandle transaction, ConnectorIdentity identity, AccessControlContext context, Privilege privilege, SchemaTableName tableName, PrestoPrincipal revokee, boolean grantOptionFor)\n    {\n        MetastoreContext metastoreContext = createMetastoreContext(identity, context);\n        if (isTableOwner(transaction, identity, metastoreContext, tableName)) {\n            return;\n        }\n\n        if (!hasGrantOptionForPrivilege(transaction, identity, metastoreContext, privilege, tableName)) {\n            denyRevokeTablePrivilege(privilege.name(), tableName.toString());\n        }\n    }\n\n    @Override\n    public void checkCanCreateRole(ConnectorTransactionHandle transactionHandle, ConnectorIdentity identity, AccessControlContext context, String role, Optional<PrestoPrincipal> grantor)\n    {\n        // currently specifying grantor is supported by metastore, but it is not supported by Hive itself\n        if (grantor.isPresent()) {\n            throw new AccessDeniedException(\"Hive Connector does not support WITH ADMIN statement\");\n        }\n        MetastoreContext metastoreContext = createMetastoreContext(identity, context);\n        if (!isAdmin(transactionHandle, identity, metastoreContext)) {\n            denyCreateRole(role);\n        }\n    }\n\n    @Override\n    public void checkCanDropRole(ConnectorTransactionHandle transactionHandle, ConnectorIdentity identity, AccessControlContext context, String role)\n    {\n        MetastoreContext metastoreContext = createMetastoreContext(identity, context);\n        if (!isAdmin(transactionHandle, identity, metastoreContext)) {\n            denyDropRole(role);\n        }\n    }\n\n    @Override\n    public void checkCanGrantRoles(ConnectorTransactionHandle transactionHandle, ConnectorIdentity identity, AccessControlContext context, Set<String> roles, Set<PrestoPrincipal> grantees, boolean withAdminOption, Optional<PrestoPrincipal> grantor, String catalogName)","sourceCodeStart":486,"sourceCodeEnd":522,"githubUrl":"https://github.com/prestodb/presto/blob/55bb57d202de3b926896fa966c2c4a44c779634e/presto-hive/src/main/java/com/facebook/presto/hive/security/SqlStandardAccessControl.java#L486-L522","documentation":"The SQL-standard access controller reports that role-management statements carrying the WITH ADMIN OPTION clause are beyond what the Hive connector's authorization model can enforce. It fires when a check call on a role-granting statement reaches a code path (e.g. checkCanCreateRole) that does not implement WITH ADMIN semantics, acting as a NOT_SUPPORTED guard.","triggerScenarios":"Thrown at presto-hive/src/main/java/com/facebook/presto/hive/security/SqlStandardAccessControl.java:504 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Rewrite the statement without the WITH ADMIN OPTION clause","Perform role administration directly in the Hive metastore or with Hive tooling instead of via Presto"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"55bb57d202de3b926896fa966c2c4a44c779634e","analyzedAt":"2026-09-04T12:50:26.162Z","contentChangedAt":"2026-09-04T12:50:26.162Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}