{"record":{"id":"e864ad49bf838be3","repo":"prestodb/presto","slug":"cannot-set-role-s","errorCode":null,"errorMessage":"Cannot set role %s","messagePattern":"Cannot set role (.+?)","errorType":"exception","errorClass":"AccessDeniedException","httpStatus":null,"severity":"error","filePath":"presto-spi/src/main/java/com/facebook/presto/spi/security/AccessDeniedException.java","lineNumber":417,"sourceCode":"\n    public static void denyDropRole(String roleName)\n    {\n        throw new AccessDeniedException(format(\"Cannot drop role %s\", roleName));\n    }\n\n    public static void denyGrantRoles(Set<String> roles, Set<PrestoPrincipal> grantees)\n    {\n        throw new AccessDeniedException(format(\"Cannot grant roles %s to %s \", roles, grantees));\n    }\n\n    public static void denyRevokeRoles(Set<String> roles, Set<PrestoPrincipal> grantees)\n    {\n        throw new AccessDeniedException(format(\"Cannot revoke roles %s from %s \", roles, grantees));\n    }\n\n    public static void denySetRole(String role)\n    {\n        throw new AccessDeniedException(format(\"Cannot set role %s\", role));\n    }\n\n    public static void denyCreateBranch(String tableName)\n    {\n        denyCreateBranch(tableName, null);\n    }\n\n    public static void denyCreateBranch(String tableName, String extraInfo)\n    {\n        throw new AccessDeniedException(format(\"Cannot create branch on table %s%s\", tableName, formatExtraInfo(extraInfo)));\n    }\n\n    public static void denyCreateTag(String tableName)\n    {\n        denyCreateTag(tableName, null);\n    }\n\n    public static void denyCreateTag(String tableName, String extraInfo)","sourceCodeStart":399,"sourceCodeEnd":435,"githubUrl":"https://github.com/prestodb/presto/blob/55bb57d202de3b926896fa966c2c4a44c779634e/presto-spi/src/main/java/com/facebook/presto/spi/security/AccessDeniedException.java#L399-L435","documentation":"AccessDeniedException.denySetRole is thrown by Presto's access-control layer when the active system access control denies a SET ROLE / SET SESSION AUTHORIZATION-style operation on the given role. Connector access controls and the configured SystemAccessControl call checkCanSetRole, which delegates to this deny method. It signals the user is not authorized to select/activate the named role, not that the role does not exist.","triggerScenarios":"A connector or SystemAccessControl implementation invokes checkCanSetRole(securityContext, catalogName, role) and its policy disallows it; Presto then calls denySetRole(role), throwing AccessDeniedException with message 'Cannot set role <role>'.","commonSituations":"Users attempting SET ROLE in a session where the configured access control (e.g. file-based system security mapping, OPA, Ranger, or a connector like Hive/Iceberg with role auth) has not granted them that role; mismatch between catalog-level and system-level role policies; typos in role grants.","solutions":["Verify the role is granted to the user/group in the access control configuration (e.g. system security JSON mapping or Ranger/OPA policy) and correct the grant or config","Confirm the exact role name (case-sensitive) matches the connector's role model","Use SET ROLE ALL or NONE where appropriate instead of a specific unauthorized role, or select a role the user does hold","Check which access control plugin is active (access-control.name in access-control.properties) and review its deny rules"],"exampleFix":"// before: user has no grant\nSET ROLE admin;\n// after: grant the role in system security mapping first\n{\n  \"role_security_mappings\": [{\"role\": \"admin\", \"users\": [\"alice\"]}]\n}\nSET ROLE admin;","handlingStrategy":"try-catch","validationCode":"// check before issuing SET ROLE (client-side)\nif (!grantedRoles.contains(requestedRole)) {\n    throw new IllegalStateException(\"Role not granted: \" + requestedRole);\n}","typeGuard":"boolean canSetRole(String role, Set<String> grantedRoles) {\n    return role != null && grantedRoles.contains(role);\n}","tryCatchPattern":"try {\n    session.execute(\"SET ROLE \" + role);\n} catch (AccessDeniedException e) {\n    LOG.warn(\"SET ROLE denied: %s\", e.getMessage());\n    throw new SecurityException(\"Not authorized to set role \" + role, e);\n}","preventionTips":["Keep role grants in the access-control config in sync with what applications request","Verify principal/group mapping (Kerberos/LDAP) matches policy rules","Log denied role attempts to spot misconfigurations early","Use least-privilege roles the service actually needs"],"tags":["presto","security","access-denied","authorization"],"backgroundTag":"access-denied-authorization","analyzedSha":"55bb57d202de3b926896fa966c2c4a44c779634e","analyzedAt":"2026-09-04T12:50:26.162Z","contentChangedAt":"2026-09-04T12:50:26.162Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}