microsoft/garnet · error · ACLCategoryDoesNotExistException

{categoryName}

Error message

{categoryName}

What it means

Thrown by ACLParser.ApplyACLOpToUser when a '+@<category>' or '-@<category>' operation names a category that GetACLCategoryByName cannot resolve (KeyNotFoundException). The recognized set is fixed: admin, bitmap, blocking, connection, dangerous, geo, hash, hyperloglog, fast, keyspace, list, pubsub, read, scripting, set, sortedset, slow, stream, string, transaction, vector, write, garnet, custom, all. Anything else raises ACLCategoryDoesNotExistException with the bad name.

Source

Thrown at libs/server/ACL/ACLParser.cs:210

                }
                catch (ACLPasswordException exception)
                {
                    throw new ACLParsingException($"{exception.Message}");
                }
            }
            else if (op.StartsWith("-@", StringComparison.Ordinal) || op.StartsWith("+@", StringComparison.Ordinal))
            {
                // Parse category name
                string categoryName = op.Substring(2);

                RespAclCategories category;
                try
                {
                    category = ACLParser.GetACLCategoryByName(categoryName);
                }
                catch (KeyNotFoundException)
                {
                    throw new ACLCategoryDoesNotExistException(categoryName);
                }

                // Add or remove the category
                if (op[0] == '-')
                {
                    user.RemoveCategory(category);
                }
                else
                {
                    user.AddCategory(category);
                }
            }
            else if (op.StartsWith('-') || op.StartsWith('+'))
            {
                // Individual commands or command|subcommand pairs
                string commandName = op.Substring(1);

                if (TryParseCommandForAcl(commandName, out RespCommand command))

View on GitHub (pinned to 951b0fc683)

Solutions

1. Use only the documented category names (see the categoryNames dictionary in ACLParser).
2. For key access use 'allkeys' or '~*' (these are key rules, handled separately), not '+@allkeys'.
3. Double-check spelling; category matching is case-insensitive but exact.
4. If extending categories, register the name in the categoryNames map before referencing it.

Example fix

// before
ACLParser.ParseACLRule("user alice on +@allkeys");

// after
ACLParser.ParseACLRule("user alice on allkeys +@read");

var known = new HashSet<string>(StringComparer.OrdinalIgnoreCase){"admin","bitmap","blocking","connection","dangerous","geo","hash","hyperloglog","fast","keyspace","list","pubsub","read","scripting","set","sortedset","slow","stream","string","transaction","vector","write","garnet","custom","all"};
if (!known.Contains(categoryName)) throw new ArgumentException($"Unknown ACL category: {categoryName}");

static bool IsKnownCategory(string name, HashSet<string> known) => known.Contains(name);

try { ACLParser.ParseACLRule(line, acl); }
catch (ACLCategoryDoesNotExistException ex) { logger.LogError("Unknown category: {Cat}", ex.Message); }

When it happens

Trigger: Using '+@allkeys' (that is a key rule, not a category), '+@write-only' (not a category), or a typo like '+@wrt'. Category names are matched case-insensitively but must be exact.

Common situations: Confusing key-pattern rules ('allkeys', '~*') with command categories; typos; using a Redis category name not implemented in Garnet; copy-pasting from a Redis config that references a category this build does not define.

Related errors

• Malformed ACL rule
• ACL rules need to start with the USER keyword
• {commandName}
• {op}
• {exception.Message}

AI-assisted analysis of microsoft/garnet@951b0fc683 (2026-08-13). Data as JSON: /api/errors/5bfd9cf17ccb1e25. Report an issue: GitHub.