{"record":{"id":"d134e3a29ed4ca77","repo":"apache/hadoop","slug":"user-cannot-perform-operation-on","errorCode":null,"errorMessage":"User {} cannot perform operation {} on {}","messagePattern":"User (.+?) cannot perform operation (.+?) on (.+?)","errorType":"exception","errorClass":"AccessControlException","httpStatus":null,"severity":"error","filePath":"hadoop-mapreduce-project/hadoop-mapreduce-client/hadoop-mapreduce-client-app/src/main/java/org/apache/hadoop/mapreduce/v2/app/client/MRClientService.java","lineNumber":211,"sourceCode":"  class MRClientProtocolHandler implements MRClientProtocol {\n\n    private RecordFactory recordFactory = \n      RecordFactoryProvider.getRecordFactory(null);\n\n    @Override\n    public InetSocketAddress getConnectAddress() {\n      return getBindAddress();\n    }\n    \n    private Job verifyAndGetJob(JobId jobID, JobACL accessType,\n        boolean exceptionThrow) throws IOException {\n      Job job = appContext.getJob(jobID);\n      if (job == null && exceptionThrow) {\n        throw new IOException(\"Unknown Job \" + jobID);\n      }\n      UserGroupInformation ugi = UserGroupInformation.getCurrentUser();\n      if (job != null && !job.checkAccess(ugi, accessType)) {\n        throw new AccessControlException(\"User \" + ugi.getShortUserName()\n            + \" cannot perform operation \" + accessType.name() + \" on \"\n            + jobID);\n      }\n      return job;\n    }\n \n    private Task verifyAndGetTask(TaskId taskID, \n        JobACL accessType) throws IOException {\n      Task task =\n          verifyAndGetJob(taskID.getJobId(), accessType, true).getTask(taskID);\n      if (task == null) {\n        throw new IOException(\"Unknown Task \" + taskID);\n      }\n      return task;\n    }\n\n    private TaskAttempt verifyAndGetAttempt(TaskAttemptId attemptID, \n        JobACL accessType) throws IOException {","sourceCodeStart":193,"sourceCodeEnd":229,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-mapreduce-project/hadoop-mapreduce-client/hadoop-mapreduce-client-app/src/main/java/org/apache/hadoop/mapreduce/v2/app/client/MRClientService.java#L193-L229","documentation":"verifyAndGetJob throws AccessControlException when the job exists but job.checkAccess(ugi, accessType) fails for the current user. Access is granted to the job owner, queue admins and cluster admins, plus users listed in the job-level ACLs (mapreduce.job.acl-view-job / mapreduce.job.acl-modify-job, intersected with the cluster-wide mapreduce.cluster.acl-view-job / acl-modify-job settings).","triggerScenarios":"A non-owner user calls getCounters/getTaskReport/killJob on the AM without being in the job ACL; job ACLs default to ' ' (empty) so nobody but owner/admins pass; cluster administrators property restricts who counts as admin.","commonSituations":"Support tooling or monitoring daemons running under a service account querying other users' jobs; shared clusters where mapreduce.job.acl-view-job was never set; users expecting to see teammates' jobs without configuring job ACLs.","solutions":["Run the client as the job owner, or have the owner set mapreduce.job.acl-view-job / mapreduce.job.acl-modify-job to a group/user list containing the caller","Widen access centrally via mapreduce.cluster.acl-view-job / mapreduce.cluster.acl-modify-job if the policy allows it","If you are the admin, verify the caller is actually resolved to the admin group (group mapping) before expecting override"],"exampleFix":"// before\njob.getTaskReports(TaskType.MAP); // AccessControlException for non-owner\n\n// after - submitting user grants view access\nconf.set(JobContext.JOB_ACL_VIEW_JOB, \"analytics,ops\");","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  job.getCounters(); // any AM RPC that passes verifyAndGetJob\n} catch (AccessControlException ace) {\n  // message shape: 'User <u> cannot perform operation <ACL> on <jobId>'\n  if (ace.getMessage().contains(\"cannot perform operation\")) {\n    // fall back: rerun as owner, or read via JHS if only view was denied\n  }\n  throw ace;\n}","preventionTips":["Set mapreduce.job.acl-view-job / acl-modify-job on shared jobs to the group that must read them","Run monitoring/service accounts through the JHS read path, which has its own admin policy","Never assume non-owners can read jobs: default job ACLs deny everyone except owner/admins"],"tags":["mapreduce","acl","authorization","access-control"],"backgroundTag":"job-acl-access-denied","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}