prestodb/presto · error · AccessDeniedException

Cannot show roles from catalog %s

Error message

Cannot show roles from catalog %s

What it means

Thrown when SHOW ROLES FROM <catalog> is not permitted for the current identity. denyShowRoles is called from checkCanShowRoles in the access control layer, which connectors invoke to gate role enumeration. Listing roles is treated as a security-sensitive metadata operation.

Source

Thrown at presto-spi/src/main/java/com/facebook/presto/spi/security/AccessDeniedException.java:337

    public static void denyGrantTablePrivilege(String privilege, String tableName, String extraInfo)
    {
        throw new AccessDeniedException(format("Cannot grant privilege %s on table %s%s", privilege, tableName, formatExtraInfo(extraInfo)));
    }

    public static void denyRevokeTablePrivilege(String privilege, String tableName)
    {
        denyRevokeTablePrivilege(privilege, tableName, null);
    }

    public static void denyRevokeTablePrivilege(String privilege, String tableName, String extraInfo)
    {
        throw new AccessDeniedException(format("Cannot revoke privilege %s on table %s%s", privilege, tableName, formatExtraInfo(extraInfo)));
    }

    public static void denyShowRoles(String catalogName)
    {
        throw new AccessDeniedException(format("Cannot show roles from catalog %s", catalogName));
    }

    public static void denyShowCurrentRoles(String catalogName)
    {
        throw new AccessDeniedException(format("Cannot show current roles from catalog %s", catalogName));
    }

    public static void denyShowRoleGrants(String catalogName)
    {
        throw new AccessDeniedException(format("Cannot show role grants from catalog %s", catalogName));
    }

    public static void denySetSystemSessionProperty(String propertyName)
    {
        denySetSystemSessionProperty(propertyName, null);
    }

    public static void denySetSystemSessionProperty(String propertyName, String extraInfo)

View on GitHub (pinned to 55bb57d202)

Solutions

  1. Have an admin run SHOW ROLES and share the list, or grant the user show-roles permission in the access control config
  2. Use the connector's own admin tooling (e.g. Hive metastore) to inspect roles
  3. Update system access control rules to allow role listing for the role the user holds

Example fix

// before
SHOW ROLES FROM hive; -- AccessDeniedException
// after (admin grants in access-control config: allow show-roles for role security_admin)
SET ROLE security_admin;
SHOW ROLES FROM hive;
Defensive patterns

Strategy: try-catch

Validate before calling

boolean canShowRoles = accessControlConfig.allows("showRoles", user, catalog);

Try / catch

try {
    return query("SHOW ROLES FROM " + catalog);
} catch (AccessDeniedException e) {
    log.warn("Role listing denied in catalog {} for {}: {}", catalog, user, e.getMessage());
    return List.of(); // degrade gracefully
}

Prevention

When it happens

Trigger: SHOW ROLES FROM catalog_name (or SHOW ROLES IN catalog) where the connector authorizer denies checkCanShowRoles for the session user.

Common situations: Users exploring role-based access in Hive/S3/Iceberg catalogs with strict security mapping; connectors where only admins may enumerate roles; missing show-roles rules in security.json.

Related errors

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/fe493a2d148905a1. Report an issue: GitHub.