prestodb/presto · warning · AccessDeniedException

Cannot set catalog session property:

Error message

Cannot set catalog session property: 

What it means

FileBasedAccessControl denies the operation outright: when the access-control rules do not grant a principal permission to set the given catalog session property, denySetSessionProperty throws AccessDeniedException, which Presto surfaces as an access-denied failure for the query/SET SESSION call.

Source

Thrown at presto-plugin-toolkit/src/main/java/com/facebook/presto/plugin/base/security/FileBasedAccessControl.java:494

            }
        }
        return false;
    }

    private boolean isDatabaseOwner(ConnectorIdentity identity, String schemaName)
    {
        for (SchemaAccessControlRule rule : schemaRules) {
            Optional<Boolean> owner = rule.match(identity.getUser(), schemaName);
            if (owner.isPresent()) {
                return owner.get();
            }
        }
        return false;
    }

    private static void denySetSessionProperty(String propertyName)
    {
        throw new AccessDeniedException("Cannot set catalog session property: " + propertyName);
    }
}

View on GitHub (pinned to 55bb57d202)

Solutions

1. Add an allow rule for the specific catalog session property in the file-based access control JSON (catalog.session-property rules)
2. Ensure catalog name and property name in the rule match exactly (case-sensitive)
3. If the property should be open, add a wildcard allow rule for catalog session properties on that catalog
4. As a stopgap, configure the property at the catalog/session level server-side so clients need not set it

Example fix

// before (access-control.json)
{
  "catalogs": [{ "user": "alice", "catalog": "hive", "privileges": ["SELECT"] }]
}
// after
{
  "catalogs": [{ "user": "alice", "catalog": "hive", "privileges": ["SELECT"] }],
  "catalogSessionProperties": [
    { "user": "alice", "catalog": "hive", "property": "bucket_execution_enabled", "allow": true }
  ]
}

# before granting users/clients, check the rules file covers the property
jq '.catalogSessionProperties[]? | select(.catalog=="hive" and .property=="my_property")' security.json

When it happens

Trigger: A user or client issues SET SESSION catalog.property=value (or via JDBC connection properties) for a catalog session property not explicitly allowed in the file-based access control rules; checkCanSetCatalogSessionProperty resolves to deny.

Common situations: BI/JDBC tools silently setting catalog session properties (e.g. Hive bucket execution, Iceberg formats) that the security.json never whitelisted; adding a new catalog without updating access-control rules; restrictive 'catalog.session-property' rules with wrong case or wrong catalog name.

Related errors

• INVALID_COLUMN_MASK
• Cannot rename a column in table %s%s
• Cannot select from table %s%s
• Cannot insert into table %s%s
• Cannot delete from table %s%s

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/8e28cfb5e43d0ca9. Report an issue: GitHub.