{"record":{"id":"f51f40103fa03405","repo":"apache/hadoop","slug":"user-s-not-allowed-to-do-s-on-s","errorCode":null,"errorMessage":"User:%s not allowed to do '%s' on '%s'","messagePattern":"User:(.+?) not allowed to do '(.+?)' on '(.+?)'","errorType":"exception","errorClass":"AuthorizationException","httpStatus":403,"severity":"error","filePath":"hadoop-common-project/hadoop-kms/src/main/java/org/apache/hadoop/crypto/key/kms/server/KMSACLs.java","lineNumber":274,"sourceCode":"        } else {\n          LOG.debug(\"user is in {}\" , blacklist.getAclString());\n        }\n      }\n    }\n    if (LOG.isDebugEnabled()) {\n      LOG.debug(\"User: [{}], Type: {} Result: {}\", ugi.getShortUserName(),\n          type.toString(), access);\n    }\n    return access;\n  }\n\n  public void assertAccess(KMSACLs.Type aclType,\n      UserGroupInformation ugi, KMSOp operation, String key)\n      throws AccessControlException {\n    if (!KMSWebApp.getACLs().hasAccess(aclType, ugi)) {\n      KMSWebApp.getUnauthorizedCallsMeter().mark();\n      KMSWebApp.getKMSAudit().unauthorized(ugi, operation, key);\n      throw new AuthorizationException(String.format(\n          (key != null) ? UNAUTHORIZED_MSG_WITH_KEY\n                        : UNAUTHORIZED_MSG_WITHOUT_KEY,\n          ugi.getShortUserName(), operation, key));\n    }\n  }\n\n  public void assertAccess(EnumSet<Type> aclTypes,\n      UserGroupInformation ugi, KMSOp operation, String key)\n      throws AccessControlException {\n    boolean accessAllowed = false;\n    for (KMSACLs.Type type : aclTypes) {\n      if (KMSWebApp.getACLs().hasAccess(type, ugi)){\n        accessAllowed = true;\n        break;\n      }\n    }\n\n    if (!accessAllowed) {","sourceCodeStart":256,"sourceCodeEnd":292,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-kms/src/main/java/org/apache/hadoop/crypto/key/kms/server/KMSACLs.java#L256-L292","documentation":"KMSACLs.assertAccess (single-ACL variant, KMS.java line 274 in KMSACLs.java) is invoked before every KMS operation. It checks the calling user against the KMS-level ACL types configured in kms-acls.xml (hadoop.kms.acl.<TYPE>, e.g. CREATE, GET, DELETE, ROLLOVER, SET_KEY_MATERIAL, GENERATE_EEK, DECRYPT_EEK, GET_KEYS, GET_CURRENT_KEY). If hasAccess fails it marks the unauthorized-calls meter, writes an audit 'unauthorized' record, and throws AuthorizationException, surfaced to REST clients as HTTP 403.","triggerScenarios":"Any KMS REST or KeyProvider call by a user who is not in the applicable hadoop.kms.acl.<TYPE> entry (and not matched by the default hadoop.kms.acl.ACL or the blacklist rules) — e.g. a GET /v1/key/name by a user missing the GET ACL, or key creation without the CREATE ACL. The key argument is non-null for key-scoped operations and null for others; the message formats user, KMSOp and key name.","commonSituations":"Fresh KMS install where kms-acls.xml still has restrictive defaults; adding a new service user (HDFS, Hive, HBase) but forgetting to add it to the ACLs; ACL hot-reload after someone tightened hadoop.kms.acl.GET; proxy-user scenarios where the doAs user is the one being checked.","solutions":["Add the short username (or a group/host range) to the relevant hadoop.kms.acl.<TYPE> entry in kms-audit... kms-acls.xml and let the ACL reload pick it up (or restart KMS)","Verify which user is actually being checked: the message shows ugi.getShortUserName(), which for proxy/doAs calls is the end user, not the proxy","Check the KMS audit log line written just before the exception to confirm the operation and key involved","Ensure the blacklist (hadoop.kms.blacklist.<TYPE>) is not overriding an allow entry for this user"],"exampleFix":"<!-- kms-acls.xml before -->\n<property><name>hadoop.kms.acl.GET</name><value>hdfs</value></property>\n<!-- after: allow the hive service user too -->\n<property><name>hadoop.kms.acl.GET</name><value>hdfs,hive</value></property>","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try { kms.createKey(name, options); } catch (AuthorizationException e) { // HTTP 403 // surface 'user not in hadoop.kms.acl.CREATE' to operators, do not retry }","preventionTips":["Provision kms-acls.xml entries for every service account before deployment","Monitor the KMS unauthorized-calls meter and audit log for denied operations","Remember doAs/proxy requests are checked against the end user, not the proxy user","After ACL edits, confirm the hot reload took effect before re-running jobs"],"tags":["hadoop-kms","authorization","http-403","acl","security","key-management"],"backgroundTag":"authorization-denied-acl","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}