prestodb/presto · error · AccessDeniedException

Cannot set system session property %s%s

Error message

Cannot set system session property %s%s

What it means

Thrown by denySetSystemSessionProperty when a client attempts to SET a system (catalog-independent) session property and the access control denies it via checkCanSetSystemSessionProperty. Presto lets deployments lock down sensitive properties (e.g. query.max-memory, resource flags) so users cannot weaken limits. The message may carry extraInfo appended when a specific denial reason is supplied.

Source

Thrown at presto-spi/src/main/java/com/facebook/presto/spi/security/AccessDeniedException.java:357

    public static void denyShowCurrentRoles(String catalogName)
    {
        throw new AccessDeniedException(format("Cannot show current roles from catalog %s", catalogName));
    }

    public static void denyShowRoleGrants(String catalogName)
    {
        throw new AccessDeniedException(format("Cannot show role grants from catalog %s", catalogName));
    }

    public static void denySetSystemSessionProperty(String propertyName)
    {
        denySetSystemSessionProperty(propertyName, null);
    }

    public static void denySetSystemSessionProperty(String propertyName, String extraInfo)
    {
        throw new AccessDeniedException(format("Cannot set system session property %s%s", propertyName, formatExtraInfo(extraInfo)));
    }

    public static void denySetCatalogSessionProperty(String catalogName, String propertyName)
    {
        denySetCatalogSessionProperty(catalogName, propertyName, null);
    }

    public static void denySetCatalogSessionProperty(String catalogName, String propertyName, String extraInfo)
    {
        throw new AccessDeniedException(format("Cannot set catalog session property %s.%s%s", catalogName, propertyName, formatExtraInfo(extraInfo)));
    }

    public static void denySetCatalogSessionProperty(String propertyName)
    {
        throw new AccessDeniedException(format("Cannot set catalog session property %s", propertyName));
    }

    public static void denySelectColumns(String tableName, Collection<String> columnNames)

View on GitHub (pinned to 55bb57d202)

Solutions

  1. Remove or defer the restricted property from your session/JDBC configuration and use cluster defaults.
  2. Ask the operator to allow the property in the system access control's allowed- (or blocked-) property list.
  3. Check the exact property name; typos can cause fallback denial paths.
  4. Use a session the policy permits (e.g. an admin) only if the change is genuinely authorized.

Example fix

// before
jdbc:presto://coordinator:8080/hive/default?sessionProperties=query.max-run-time=1d
// after: drop the restricted override and tune via cluster config
jdbc:presto://coordinator:8080/hive/default
Defensive patterns

Strategy: validation

Validate before calling

// Maintain the deployment's blocked/allowed system property list client-side
Set<String> restricted = loadRestrictedSystemProperties(); // from access-control config
if (restricted.contains(propertyName)) {
    throw new IllegalArgumentException("Property not settable here: " + propertyName);
}

Try / catch

try {
    stmt.execute("SET SESSION " + prop + " = " + value);
} catch (AccessDeniedException e) {
    log.warn("System property {} blocked by access control; using cluster default", prop);
}

Prevention

When it happens

Trigger: Executing 'SET SESSION <system_property> = value' (or JDBC connection session properties) for a property listed as restricted in the system access control configuration.

Common situations: Clients pre-setting tuning properties in JDBC URLs against clusters with property whitelists; upgrading Presto where a property newly became restricted; scripts setting query.* properties the ops team has frozen.

Related errors

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/3bee0f5b85484941. Report an issue: GitHub.