prestodb/presto · error · AccessDeniedException

Cannot set catalog session property %s

Error message

Cannot set catalog session property %s

What it means

Overload of denySetCatalogSessionProperty taking only the propertyName; it throws the same AccessDeniedException without a catalog prefix in the message. It is used when the denial applies to a catalog session property where the catalog is implicit/unavailable in the check. Semantically identical to the catalog+property variant: the user may not change that connector session property.

Source

Thrown at presto-spi/src/main/java/com/facebook/presto/spi/security/AccessDeniedException.java:372

    public static void denySetSystemSessionProperty(String propertyName, String extraInfo)
    {
        throw new AccessDeniedException(format("Cannot set system session property %s%s", propertyName, formatExtraInfo(extraInfo)));
    }

    public static void denySetCatalogSessionProperty(String catalogName, String propertyName)
    {
        denySetCatalogSessionProperty(catalogName, propertyName, null);
    }

    public static void denySetCatalogSessionProperty(String catalogName, String propertyName, String extraInfo)
    {
        throw new AccessDeniedException(format("Cannot set catalog session property %s.%s%s", catalogName, propertyName, formatExtraInfo(extraInfo)));
    }

    public static void denySetCatalogSessionProperty(String propertyName)
    {
        throw new AccessDeniedException(format("Cannot set catalog session property %s", propertyName));
    }

    public static void denySelectColumns(String tableName, Collection<String> columnNames)
    {
        denySelectColumns(tableName, columnNames, null);
    }

    public static void denySelectColumns(String tableName, Collection<String> columnNames, String extraInfo)
    {
        throw new AccessDeniedException(format("Cannot select from columns %s in table or view %s%s", columnNames.stream().sorted().collect(Collectors.toList()), tableName, formatExtraInfo(extraInfo)));
    }

    public static void denyCallProcedure(String procedureName)
    {
        denyCallProcedure(procedureName, null);
    }

    public static void denyCallProcedure(String procedureName, String extraInfo)

View on GitHub (pinned to 55bb57d202)

Solutions

  1. Remove the session property override from the client/JDBC config.
  2. Request that the property be allowed for your principal in access control rules.
  3. Set the value in the connector's catalog properties file instead of per-session.
  4. Check property spelling and that it is a real connector property.

Example fix

// before
SET SESSION oracle.fetch_size = 50000;
// after
-- removed; rely on catalog default or ask admin to permit it
Defensive patterns

Strategy: validation

Validate before calling

// Same guard, single-argument path
if (!isCatalogPropertyAllowedForUser(currentCatalog, propertyName, currentUser)) {
    skipSessionPropertyOverride(propertyName);
}

Try / catch

try {
    stmt.execute("SET SESSION " + prop + " = " + value);
} catch (AccessDeniedException e) {
    log.warn("Session property {} denied; keeping default", prop);
}

Prevention

When it happens

Trigger: The same SET SESSION on a connector property, routed through the single-argument overload when the authorizer denies without catalog context.

Common situations: Same as the catalog-qualified variant: restricted connector properties, shared clusters with locked-down tuning knobs, hardcoded session settings in legacy clients.

Related errors

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/3c34f07434b7b8a9. Report an issue: GitHub.