prestodb/presto · error · AccessDeniedException

Cannot show role grants from catalog %s

Error message

Cannot show role grants from catalog %s

What it means

This AccessDeniedException is thrown by denyShowRoleGrants when the active security layer (system access control or connector authorizer) rejects a SHOW ROLE GRANTS request for a catalog. Presto's security model centralizes authorization in AccessControlManager, which calls checkCanShowRoleGrants on the configured access control; any denial is funneled here. The user's identity simply lacks the SHOW_ROLE_GRANTS privilege in that catalog.

Source

Thrown at presto-spi/src/main/java/com/facebook/presto/spi/security/AccessDeniedException.java:347

    public static void denyRevokeTablePrivilege(String privilege, String tableName, String extraInfo)
    {
        throw new AccessDeniedException(format("Cannot revoke privilege %s on table %s%s", privilege, tableName, formatExtraInfo(extraInfo)));
    }

    public static void denyShowRoles(String catalogName)
    {
        throw new AccessDeniedException(format("Cannot show roles from catalog %s", catalogName));
    }

    public static void denyShowCurrentRoles(String catalogName)
    {
        throw new AccessDeniedException(format("Cannot show current roles from catalog %s", catalogName));
    }

    public static void denyShowRoleGrants(String catalogName)
    {
        throw new AccessDeniedException(format("Cannot show role grants from catalog %s", catalogName));
    }

    public static void denySetSystemSessionProperty(String propertyName)
    {
        denySetSystemSessionProperty(propertyName, null);
    }

    public static void denySetSystemSessionProperty(String propertyName, String extraInfo)
    {
        throw new AccessDeniedException(format("Cannot set system session property %s%s", propertyName, formatExtraInfo(extraInfo)));
    }

    public static void denySetCatalogSessionProperty(String catalogName, String propertyName)
    {
        denySetCatalogSessionProperty(catalogName, propertyName, null);
    }

    public static void denySetCatalogSessionProperty(String catalogName, String propertyName, String extraInfo)

View on GitHub (pinned to 55bb57d202)

Solutions

1. Request SHOW_ROLE_GRANTS privilege or security-admin role on the catalog from your administrator.
2. Review the configured access control rules (etc/access-control.properties or connector authorizer) and add an allow rule for the principal.
3. Verify you are connected to the intended catalog; grants are per-catalog.
4. As a non-admin, ask the admin to run the query and share the output.

Example fix

// before: denied for regular user
SHOW ROLE GRANTS FROM hive;
// after: run as a user granted admin in the access control rules, e.g.
// access-control.properties: security-admin-user=bob
// then, as bob:
SHOW ROLE GRANTS FROM hive;

// Check privileges before SHOW ROLE GRANTS:
// SELECT * FROM system.security.roles();  or consult your access-control config
boolean canShowRoleGrants = currentUserHasSystemAccessControlRuleFor("SHOW_ROLE_GRANTS", catalogName);

try {
    session.execute("SHOW ROLE GRANTS FROM " + catalogName);
} catch (AccessDeniedException e) {
    // SQLSTATE: insufficient privileges — surface to admin or fall back to admin-run query
    log.warn("Not permitted to show role grants in {}: {}", catalogName, e.getMessage());
}

When it happens

Trigger: Running 'SHOW ROLE GRANTS FROM <catalog>' (or SET ROLE-related introspection) when the access control's checkCanShowRoleGrants denies the session user for that catalogName.

Common situations: Developers querying role grants without being a security admin; catalogs whose access control only lets certain principals inspect role mappings; misreading a policy file (e.g. file-based system access control) that omits the user from admin rules.

Related errors

• Cannot create role %s
• Cannot drop role %s
• Cannot grant roles %s to %s
• Cannot revoke roles %s from %s
• Cannot set catalog session property:

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/4edc04631a2dcf30. Report an issue: GitHub.