juicedata/juicefs · error · IOException

permission denied

Error message

permission denied

What it means

Generic permission-denied signal in the delegation token lifecycle: when jfs_renew_token or jfs_cancel_token returns EACCESS the caller is not the token owner or renewer, so the metadata engine rejects the operation.

Source

Thrown at sdk/java/src/main/java/io/juicefs/JuiceFileSystemImpl.java:2432

            realUser);
    identifier.setIssueDate(issueDate);
    identifier.setMaxDate(maxDate);
    identifier.setMasterKeyId(id);

    return new Token<>(
        identifier.getBytes(),
        pwd,
        identifier.getKind(),
        new Text(getCanonicalServiceName()));
  }

  public long renewToken(Token<?> token) throws IOException {
    AbstractDelegationTokenIdentifier identifier = (AbstractDelegationTokenIdentifier) token.decodeIdentifier();
    int id = identifier.getMasterKeyId();
    String pwd = new String(token.getPassword(), StandardCharsets.UTF_8);
    long r = lib.jfs_renew_token(handle, id, pwd);
    if (r == EACCESS) {
      throw new IOException("permission denied");
    }
    if (r < 0) {
      throw new IOException(String.format("renew token failed, return code %d", r));
    }
    return r * 1000;
  }

  public void cancelToken(Token<?> token) throws IOException {
    AbstractDelegationTokenIdentifier identifier = (AbstractDelegationTokenIdentifier) token.decodeIdentifier();
    int id = identifier.getMasterKeyId();
    String pwd = new String(token.getPassword(), StandardCharsets.UTF_8);
    int r = lib.jfs_cancel_token(handle, id, pwd);
    if (r == EACCESS) {
      throw new IOException("permission denied");
    }
    if (r < 0) {
      throw new IOException(String.format("cancel token failed, return code %d", r));
    }

View on GitHub (pinned to c9a67b23e8)

Solutions

1. Renew or cancel the token using the same user (or configured renewer) that obtained it
2. Verify token delegation settings in the volume format

When it happens

Trigger: Thrown at sdk/java/src/main/java/io/juicefs/JuiceFileSystemImpl.java:2432 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of juicedata/juicefs@c9a67b23e8 (2026-09-06). Data as JSON: /api/errors/c0cb9d995dd4e4c0. Report an issue: GitHub.