prestodb/presto · error · AccessDeniedException

Cannot show current roles from catalog %s

Error message

Cannot show current roles from catalog %s

What it means

Thrown when SHOW CURRENT ROLES FROM <catalog> is denied for the current identity. denyShowCurrentRoles is called from checkCanShowCurrentRoles in the access control layer. It reports the roles active for the session and is gated separately from general role listing.

Source

Thrown at presto-spi/src/main/java/com/facebook/presto/spi/security/AccessDeniedException.java:342

    public static void denyRevokeTablePrivilege(String privilege, String tableName)
    {
        denyRevokeTablePrivilege(privilege, tableName, null);
    }

    public static void denyRevokeTablePrivilege(String privilege, String tableName, String extraInfo)
    {
        throw new AccessDeniedException(format("Cannot revoke privilege %s on table %s%s", privilege, tableName, formatExtraInfo(extraInfo)));
    }

    public static void denyShowRoles(String catalogName)
    {
        throw new AccessDeniedException(format("Cannot show roles from catalog %s", catalogName));
    }

    public static void denyShowCurrentRoles(String catalogName)
    {
        throw new AccessDeniedException(format("Cannot show current roles from catalog %s", catalogName));
    }

    public static void denyShowRoleGrants(String catalogName)
    {
        throw new AccessDeniedException(format("Cannot show role grants from catalog %s", catalogName));
    }

    public static void denySetSystemSessionProperty(String propertyName)
    {
        denySetSystemSessionProperty(propertyName, null);
    }

    public static void denySetSystemSessionProperty(String propertyName, String extraInfo)
    {
        throw new AccessDeniedException(format("Cannot set system session property %s%s", propertyName, formatExtraInfo(extraInfo)));
    }

    public static void denySetCatalogSessionProperty(String catalogName, String propertyName)

View on GitHub (pinned to 55bb57d202)

Solutions

  1. Grant show-current-roles permission in the access control configuration for the user/role
  2. Have an admin run the statement on the user's behalf
  3. Check your own current roles (without FOR USER) if allowed by policy

Example fix

// before
SHOW CURRENT ROLES FROM hive FOR USER bob; -- AccessDeniedException
// after (in access-control json)
// { "showCurrentRoles": { "allow": true } } for admin role
SHOW CURRENT ROLES FROM hive; -- as admin
Defensive patterns

Strategy: try-catch

Validate before calling

boolean canShowCurrentRoles = accessControlConfig.allows("showCurrentRoles", user, catalog);

Try / catch

try {
    return query("SHOW CURRENT ROLES FROM " + catalog);
} catch (AccessDeniedException e) {
    log.warn("Current-role listing denied in catalog {}: {}", catalog, e.getMessage());
    return List.of();
}

Prevention

When it happens

Trigger: SHOW CURRENT ROLES FROM catalog_name (optionally FOR USER x) where checkCanShowCurrentRoles is denied; querying another user's current roles is often denied even when viewing your own is allowed.

Common situations: Admins checking effective roles per user in role-enabled connectors (Hive/Iceberg); security configs granting show-roles but not show-current-roles; session role activation confusion.

Related errors

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/8aa8d613a5ae6fd5. Report an issue: GitHub.