{"record":{"id":"fe493a2d148905a1","repo":"prestodb/presto","slug":"cannot-show-roles-from-catalog-s","errorCode":null,"errorMessage":"Cannot show roles from catalog %s","messagePattern":"Cannot show roles from catalog (.+?)","errorType":"exception","errorClass":"AccessDeniedException","httpStatus":null,"severity":"error","filePath":"presto-spi/src/main/java/com/facebook/presto/spi/security/AccessDeniedException.java","lineNumber":337,"sourceCode":"\n    public static void denyGrantTablePrivilege(String privilege, String tableName, String extraInfo)\n    {\n        throw new AccessDeniedException(format(\"Cannot grant privilege %s on table %s%s\", privilege, tableName, formatExtraInfo(extraInfo)));\n    }\n\n    public static void denyRevokeTablePrivilege(String privilege, String tableName)\n    {\n        denyRevokeTablePrivilege(privilege, tableName, null);\n    }\n\n    public static void denyRevokeTablePrivilege(String privilege, String tableName, String extraInfo)\n    {\n        throw new AccessDeniedException(format(\"Cannot revoke privilege %s on table %s%s\", privilege, tableName, formatExtraInfo(extraInfo)));\n    }\n\n    public static void denyShowRoles(String catalogName)\n    {\n        throw new AccessDeniedException(format(\"Cannot show roles from catalog %s\", catalogName));\n    }\n\n    public static void denyShowCurrentRoles(String catalogName)\n    {\n        throw new AccessDeniedException(format(\"Cannot show current roles from catalog %s\", catalogName));\n    }\n\n    public static void denyShowRoleGrants(String catalogName)\n    {\n        throw new AccessDeniedException(format(\"Cannot show role grants from catalog %s\", catalogName));\n    }\n\n    public static void denySetSystemSessionProperty(String propertyName)\n    {\n        denySetSystemSessionProperty(propertyName, null);\n    }\n\n    public static void denySetSystemSessionProperty(String propertyName, String extraInfo)","sourceCodeStart":319,"sourceCodeEnd":355,"githubUrl":"https://github.com/prestodb/presto/blob/55bb57d202de3b926896fa966c2c4a44c779634e/presto-spi/src/main/java/com/facebook/presto/spi/security/AccessDeniedException.java#L319-L355","documentation":"Thrown when SHOW ROLES FROM <catalog> is not permitted for the current identity. denyShowRoles is called from checkCanShowRoles in the access control layer, which connectors invoke to gate role enumeration. Listing roles is treated as a security-sensitive metadata operation.","triggerScenarios":"SHOW ROLES FROM catalog_name (or SHOW ROLES IN catalog) where the connector authorizer denies checkCanShowRoles for the session user.","commonSituations":"Users exploring role-based access in Hive/S3/Iceberg catalogs with strict security mapping; connectors where only admins may enumerate roles; missing show-roles rules in security.json.","solutions":["Have an admin run SHOW ROLES and share the list, or grant the user show-roles permission in the access control config","Use the connector's own admin tooling (e.g. Hive metastore) to inspect roles","Update system access control rules to allow role listing for the role the user holds"],"exampleFix":"// before\nSHOW ROLES FROM hive; -- AccessDeniedException\n// after (admin grants in access-control config: allow show-roles for role security_admin)\nSET ROLE security_admin;\nSHOW ROLES FROM hive;","handlingStrategy":"try-catch","validationCode":"boolean canShowRoles = accessControlConfig.allows(\"showRoles\", user, catalog);","typeGuard":null,"tryCatchPattern":"try {\n    return query(\"SHOW ROLES FROM \" + catalog);\n} catch (AccessDeniedException e) {\n    log.warn(\"Role listing denied in catalog {} for {}: {}\", catalog, user, e.getMessage());\n    return List.of(); // degrade gracefully\n}","preventionTips":["Include show-roles rules when authoring security.json access control files","Use connector-native tooling for role inspection instead of ad-hoc SHOW statements","Keep role discovery restricted to break-glass/admin roles"],"tags":["security","authorization","roles","metadata"],"backgroundTag":"access-denied","analyzedSha":"55bb57d202de3b926896fa966c2c4a44c779634e","analyzedAt":"2026-09-04T12:50:26.162Z","contentChangedAt":"2026-09-04T12:50:26.162Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}