{"record":{"id":"ef6721c793b0bc32","repo":"prestodb/presto","slug":"hive-ranger-server-error","errorCode":"HIVE_RANGER_SERVER_ERROR","errorMessage":"Unable to fetch policy information from ranger","messagePattern":"Unable to fetch policy information from ranger","errorType":"error_code","errorClass":"PrestoException","httpStatus":null,"severity":"critical","filePath":"presto-hive/src/main/java/com/facebook/presto/hive/security/ranger/RangerAuthorizer.java","lineNumber":104,"sourceCode":"        plugin.setResultProcessor(new RangerDefaultAuditHandler());\n    }\n\n    private void updateRangerPolicies()\n    {\n        ServicePolicies newServicePolicies = getRangerServicePolicies();\n        ServicePolicies existingServicePolicies = currentServicePolicies.get();\n        if (newServicePolicies != existingServicePolicies && currentServicePolicies.compareAndSet(existingServicePolicies, newServicePolicies)) {\n            plugin.setPolicies(newServicePolicies);\n        }\n    }\n\n    private ServicePolicies getRangerServicePolicies()\n    {\n        try {\n            return servicePolicies.get();\n        }\n        catch (Exception ex) {\n            throw new PrestoException(HIVE_RANGER_SERVER_ERROR, \"Unable to fetch policy information from ranger\", ex);\n        }\n    }\n\n    public boolean authorizeHiveResource(String database, String table, String column, String accessType, String user, Set<String> userGroups, Set<String> userRoles)\n    {\n        updateRangerPolicies();\n        RangerAccessResourceImpl resource = new RangerAccessResourceImpl();\n        if (!isNullOrEmpty(database)) {\n            resource.setValue(KEY_DATABASE, database);\n        }\n\n        if (!isNullOrEmpty(table)) {\n            resource.setValue(KEY_TABLE, table);\n        }\n\n        if (!isNullOrEmpty(column)) {\n            resource.setValue(KEY_COLUMN, column);\n        }","sourceCodeStart":86,"sourceCodeEnd":122,"githubUrl":"https://github.com/prestodb/presto/blob/55bb57d202de3b926896fa966c2c4a44c779634e/presto-hive/src/main/java/com/facebook/presto/hive/security/ranger/RangerAuthorizer.java#L86-L122","documentation":"RangerAuthorizer could not retrieve the cached Ranger ServicePolicies; the Future (servicePolicies.get()) threw, wrapped as a PrestoException with HIVE_RANGER_SERVER_ERROR. This usually reflects the underlying Ranger admin REST call failing or the policy-refresh background task erroring.","triggerScenarios":"authorizeHiveResource / updateRangerPolicies calls getRangerServicePolicies while the policy Future has failed — e.g. Ranger admin unreachable, HTTP error, auth failure, or malformed policy response.","commonSituations":"Ranger admin service down or restarted; wrong ranger.http.end-point; network/firewall between Presto and Ranger; expired Ranger auth credentials; stale failed Future after a Ranger outage.","solutions":["Verify the Ranger admin endpoint is reachable (curl the ranger.http.end-point from the coordinator)","Check Ranger admin service health, auth credentials and plugin logs","Fix the underlying exception (chained as the cause) — network, HTTP status, or JSON parse errors","Restart the Presto coordinator so the policy-refresh task is re-established","Increase refreshPeriod or retry tolerance if Ranger is intermittently slow"],"exampleFix":"// before (config)\nranger.http.end-point=http://ranger-old:6080\n// after\nranger.http.end-point=http://ranger-admin.example.com:6080","handlingStrategy":"retry","validationCode":"// preflight: check Ranger admin health before issuing queries\nint status = httpHead(rangerEndPoint + \"/service/plugins/policies\").getStatusCode();\nif (status != 200) throw new IllegalStateException(\"Ranger admin unavailable\");","typeGuard":null,"tryCatchPattern":"try {\n    runQuery();\n} catch (PrestoException e) {\n    if (\"HIVE_RANGER_SERVER_ERROR\".equals(e.getErrorCode().getName())\n            && e.getMessage().contains(\"Unable to fetch policy information\")) {\n        // alert on Ranger availability, backoff and retry\n    } else throw e;\n}","preventionTips":["Monitor Ranger admin uptime and alert before query impact","Keep refreshPeriod reasonable so policies re-fetch promptly after outages","Pin a stable, reachable ranger.http.end-point in the catalog properties","Inspect the chained cause promptly — it distinguishes network vs auth vs parse failures"],"tags":["ranger","hive","authorization","network","presto-exception"],"backgroundTag":"policy-fetch-failed","analyzedSha":"55bb57d202de3b926896fa966c2c4a44c779634e","analyzedAt":"2026-09-04T12:50:26.162Z","contentChangedAt":"2026-09-04T12:50:26.162Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}