prestodb/presto · error · AccessDeniedException

Cannot set role %s

Error message

Cannot set role %s

What it means

AccessDeniedException.denySetRole is thrown by Presto's access-control layer when the active system access control denies a SET ROLE / SET SESSION AUTHORIZATION-style operation on the given role. Connector access controls and the configured SystemAccessControl call checkCanSetRole, which delegates to this deny method. It signals the user is not authorized to select/activate the named role, not that the role does not exist.

Source

Thrown at presto-spi/src/main/java/com/facebook/presto/spi/security/AccessDeniedException.java:417

    public static void denyDropRole(String roleName)
    {
        throw new AccessDeniedException(format("Cannot drop role %s", roleName));
    }

    public static void denyGrantRoles(Set<String> roles, Set<PrestoPrincipal> grantees)
    {
        throw new AccessDeniedException(format("Cannot grant roles %s to %s ", roles, grantees));
    }

    public static void denyRevokeRoles(Set<String> roles, Set<PrestoPrincipal> grantees)
    {
        throw new AccessDeniedException(format("Cannot revoke roles %s from %s ", roles, grantees));
    }

    public static void denySetRole(String role)
    {
        throw new AccessDeniedException(format("Cannot set role %s", role));
    }

    public static void denyCreateBranch(String tableName)
    {
        denyCreateBranch(tableName, null);
    }

    public static void denyCreateBranch(String tableName, String extraInfo)
    {
        throw new AccessDeniedException(format("Cannot create branch on table %s%s", tableName, formatExtraInfo(extraInfo)));
    }

    public static void denyCreateTag(String tableName)
    {
        denyCreateTag(tableName, null);
    }

    public static void denyCreateTag(String tableName, String extraInfo)

View on GitHub (pinned to 55bb57d202)

Solutions

  1. Verify the role is granted to the user/group in the access control configuration (e.g. system security JSON mapping or Ranger/OPA policy) and correct the grant or config
  2. Confirm the exact role name (case-sensitive) matches the connector's role model
  3. Use SET ROLE ALL or NONE where appropriate instead of a specific unauthorized role, or select a role the user does hold
  4. Check which access control plugin is active (access-control.name in access-control.properties) and review its deny rules

Example fix

// before: user has no grant
SET ROLE admin;
// after: grant the role in system security mapping first
{
  "role_security_mappings": [{"role": "admin", "users": ["alice"]}]
}
SET ROLE admin;
Defensive patterns

Strategy: try-catch

Validate before calling

// check before issuing SET ROLE (client-side)
if (!grantedRoles.contains(requestedRole)) {
    throw new IllegalStateException("Role not granted: " + requestedRole);
}

Type guard

boolean canSetRole(String role, Set<String> grantedRoles) {
    return role != null && grantedRoles.contains(role);
}

Try / catch

try {
    session.execute("SET ROLE " + role);
} catch (AccessDeniedException e) {
    LOG.warn("SET ROLE denied: %s", e.getMessage());
    throw new SecurityException("Not authorized to set role " + role, e);
}

Prevention

When it happens

Trigger: A connector or SystemAccessControl implementation invokes checkCanSetRole(securityContext, catalogName, role) and its policy disallows it; Presto then calls denySetRole(role), throwing AccessDeniedException with message 'Cannot set role <role>'.

Common situations: Users attempting SET ROLE in a session where the configured access control (e.g. file-based system security mapping, OPA, Ranger, or a connector like Hive/Iceberg with role auth) has not granted them that role; mismatch between catalog-level and system-level role policies; typos in role grants.

Related errors

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/e864ad49bf838be3. Report an issue: GitHub.