prestodb/presto · error · AccessDeniedException

Cannot set catalog session property %s.%s%s

Error message

Cannot set catalog session property %s.%s%s

What it means

Thrown by denySetCatalogSessionProperty(catalog, property[, extraInfo]) when setting a connector (catalog-level) session property is denied by checkCanSetCatalogSessionProperty. Connectors expose properties like hive.bucket-execution or memory settings; deployments often restrict who may change them. The extraInfo suffix conveys an optional denial reason from the authorizer.

Source

Thrown at presto-spi/src/main/java/com/facebook/presto/spi/security/AccessDeniedException.java:367

    public static void denySetSystemSessionProperty(String propertyName)
    {
        denySetSystemSessionProperty(propertyName, null);
    }

    public static void denySetSystemSessionProperty(String propertyName, String extraInfo)
    {
        throw new AccessDeniedException(format("Cannot set system session property %s%s", propertyName, formatExtraInfo(extraInfo)));
    }

    public static void denySetCatalogSessionProperty(String catalogName, String propertyName)
    {
        denySetCatalogSessionProperty(catalogName, propertyName, null);
    }

    public static void denySetCatalogSessionProperty(String catalogName, String propertyName, String extraInfo)
    {
        throw new AccessDeniedException(format("Cannot set catalog session property %s.%s%s", catalogName, propertyName, formatExtraInfo(extraInfo)));
    }

    public static void denySetCatalogSessionProperty(String propertyName)
    {
        throw new AccessDeniedException(format("Cannot set catalog session property %s", propertyName));
    }

    public static void denySelectColumns(String tableName, Collection<String> columnNames)
    {
        denySelectColumns(tableName, columnNames, null);
    }

    public static void denySelectColumns(String tableName, Collection<String> columnNames, String extraInfo)
    {
        throw new AccessDeniedException(format("Cannot select from columns %s in table or view %s%s", columnNames.stream().sorted().collect(Collectors.toList()), tableName, formatExtraInfo(extraInfo)));
    }

    public static void denyCallProcedure(String procedureName)

View on GitHub (pinned to 55bb57d202)

Solutions

  1. Drop the catalog property override and rely on connector/catalog defaults.
  2. Have the operator whitelist the property (and your role) in the access control rules.
  3. Confirm the property belongs to the catalog you targeted; use the correct catalog prefix.
  4. Move the tuning into the catalog's properties file (etc/catalog/*.properties) managed by ops.

Example fix

// before (denied)
SET SESSION hive.max_split_size = '1GB';
// after: ask ops to set it server-side
// etc/catalog/hive.properties:
//   hive.max-split-size=1GB
Defensive patterns

Strategy: validation

Validate before calling

// Pre-check against the connector's governed property list
if (!isCatalogPropertyAllowedForUser(catalogName, propertyName, currentUser)) {
    skipSessionPropertyOverride(catalogName, propertyName);
}

Try / catch

try {
    stmt.execute(String.format("SET SESSION %s.%s = '%s'", catalog, prop, value));
} catch (AccessDeniedException e) {
    log.warn("Catalog property {}.{} denied: {}", catalog, prop, e.getMessage());
}

Prevention

When it happens

Trigger: Executing 'SET SESSION <catalog>.<property> = value' or supplying the catalog property via JDBC/CLI when the access control denies the user for that catalogName/propertyName pair.

Common situations: Tuning Hive/ICEBERG connector properties in a shared cluster where only service accounts may; CI jobs setting properties hard-coded from older setups; connectors whose properties became governed after an upgrade.

Related errors

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/988dc170bc78e7a7. Report an issue: GitHub.