dgraph-io/dgraph · error

cannot force namespace %#x when provided creds are not of su

Error message

cannot force namespace %#x when provided creds are not of superadmin user

What it means

The `dgraph live` loader refuses to apply a --force-namespace flag when the credentials used are not those of the Dgraph superadmin (guardians) user. Forcing a target namespace is a superadmin-only operation because it writes into an arbitrary namespace that the normal ACLs would not permit. The check lives in the namespace option resolution switch in run.go and rejects the run before any data is sent to the Alpha.

Source

Thrown at dgraph/cmd/live/run.go:700

		httpAddr:        Live.Conf.GetString("http"),
		bufferSize:      Live.Conf.GetInt("bufferSize"),
		upsertPredicate: Live.Conf.GetString("upsertPredicate"),
		tmpDir:          Live.Conf.GetString("tmp"),
		key:             keys.EncKey,
	}

	forceNs := Live.Conf.GetInt64("force-namespace")
	switch creds.GetUint64("namespace") {
	case x.RootNamespace:
		if forceNs < 0 {
			opt.preserveNs = true
			opt.namespaceToLoad = math.MaxUint64
		} else {
			opt.namespaceToLoad = uint64(forceNs)
		}
	default:
		if Live.Conf.IsSet("force-namespace") {
			return errors.Errorf("cannot force namespace %#x when provided creds are not of"+
				" superadmin user", forceNs)
		}
	}

	z.SetTmpDir(opt.tmpDir)

	go func() {
		if err := http.ListenAndServe(opt.httpAddr, x.SanitizedDefaultServeMux()); err != nil {
			glog.Errorf("Error while starting HTTP server: %+v", err)
		}
	}()
	ctx := context.Background()
	// singleNsOp is set to false, when loading data into a namespace different from the one user
	// provided credentials for.
	singleNsOp := true
	if len(creds.GetString("user")) > 0 && creds.GetUint64("namespace") == x.RootNamespace &&
		opt.namespaceToLoad != x.RootNamespace {
		singleNsOp = false

View on GitHub (pinned to 759e242be6)

Solutions

1. Run dgraph live with credentials (or --hmac-secret) belonging to the superadmin/guardian user
2. Remove the --force-namespace flag and load into the namespace your user is authorized for
3. Create or designate a superadmin user and obtain its credentials before running the loader

Example fix

// before (regular user creds)
dgraph live --creds "user=appUser;password=xxx" --force-namespace 0x2 -f data.rdf
// after (superadmin creds)
dgraph live --creds "user=groot;password=password" --force-namespace 0x2 -f data.rdf

// Before running dgraph live with --force-namespace, confirm superadmin creds
// e.g. verify the user can hit the admin endpoint:
const resp = await fetch('http://alpha:8080/admin', {
  method: 'POST',
  body: JSON.stringify({ query: '{ checkUser(username: "groot", password: "pw") { response { code } } }' })
});
const j = await resp.json();
if (!j.data?.checkUser?.response?.code === 'Success') {
  throw new Error('Credentials are not superadmin; do not use --force-namespace');
}

function isSuperadminLogin(loginResult) {
  return loginResult?.data?.checkUser?.response?.code === 'Success';
}

try {
  await runLiveLoader({ creds, forceNamespace });
} catch (e) {
  if (String(e.message).includes('cannot force namespace')) {
    console.error('Non-superadmin creds used with --force-namespace; retry as guardian user or drop the flag');
  } else { throw e; }
}

When it happens

Trigger: Running `dgraph live --force-namespace <id> ...` while authenticating with a regular (non-superadmin) user's credentials/hmac key instead of a guardian account's.

Common situations: Multi-tenant Dgraph deployments where an operator copies a documented load command but logs in with a limited ACL user; migrating tenants after ACLs were introduced; using an admin key generated for a namespace-restricted user.

Related errors

• error while creating debug file: %s
• Upsert Predicate feature is not supported for loadinginto mu
• Cannot load into namespace %#x. It does not exist.
• While upserting user with id %s
• Authorize guardian of the galaxy, extracting jwt token, erro

AI-assisted analysis of dgraph-io/dgraph@759e242be6 (2026-09-01). Data as JSON: /api/errors/2bc42ec553171b7f. Report an issue: GitHub.