prestodb/presto · error · MetaException

GrantRevokeResponse missing success field

Error message

GrantRevokeResponse missing success field

What it means

ThriftHiveMetastoreClient.createGrant sends a GrantRevokeRoleRequest to the Hive metastore via grant_revoke_role. The response object carries an optional 'success' field; if the metastore (typically an older Hive version) never sets it, Presto cannot confirm the grant succeeded and throws MetaException("GrantRevokeResponse missing success field"). This is a defensive protocol check against metastores that don't honor the response contract.

Source

Thrown at presto-hive-metastore/src/main/java/com/facebook/presto/hive/metastore/thrift/ThriftHiveMetastoreClient.java:432

            }
        }
        createGrant(role, granteeName, granteeType, grantorName, grantorType, grantOption);
    }

    private void createGrant(String role, String granteeName, PrincipalType granteeType, String grantorName, PrincipalType grantorType, boolean grantOption)
            throws TException
    {
        GrantRevokeRoleRequest request = new GrantRevokeRoleRequest();
        request.setRequestType(GrantRevokeType.GRANT);
        request.setRoleName(role);
        request.setPrincipalName(granteeName);
        request.setPrincipalType(granteeType);
        request.setGrantor(grantorName);
        request.setGrantorType(grantorType);
        request.setGrantOption(grantOption);
        GrantRevokeRoleResponse response = client.grant_revoke_role(request);
        if (!response.isSetSuccess()) {
            throw new MetaException("GrantRevokeResponse missing success field");
        }
    }

    @Override
    public void revokeRole(String role, String granteeName, PrincipalType granteeType, boolean grantOption)
            throws TException
    {
        List<RolePrincipalGrant> grants = listRoleGrants(granteeName, granteeType);
        RolePrincipalGrant currentGrant = null;
        for (RolePrincipalGrant grant : grants) {
            if (grant.getRoleName().equals(role)) {
                currentGrant = grant;
                break;
            }
        }

        if (currentGrant == null) {
            return;

View on GitHub (pinned to 55bb57d202)

Solutions

1. Upgrade the Hive metastore to a version whose grant_revoke_role sets the success field in GrantRevokeRoleResponse.
2. Verify the actual grant took effect with SHOW GRANTS / listRoleGrants; if it did, the error is a false negative from the missing field.
3. Check for a proxy/metastore-routing layer (Waggle Dance, Glue catalog) stripping or not propagating the response field, and bypass or upgrade it.
4. As a workaround, create the grant directly in Hive and verify in Presto with SHOW GRANTS.

// before issuing GRANT, verify the metastore supports role grants
List<String> roles = metastore.listRoleNames(); // throws/errs if RBAC unsupported
// and check metastore version >= 2.x if GrantRevokeRoleResponse.success is required

try {
    accessControl.grantRoles(...);
}
catch (PrestoException e) {
    if (e.getCause() instanceof MetaException
            && e.getCause().getMessage().contains("missing success field")) {
        // verify actual state, e.g. SHOW GRANTS, and warn about metastore version
    }
    throw e;
}

When it happens

Trigger: Calling grantRole (GRANT role TO user/role in Presto), which calls createGrant, when the metastore's GrantRevokeRoleResponse has success unset — i.e. a Hive metastore version whose thrift definition predates the success field, or a metastore implementation that returns a default-constructed response.

Common situations: Older Hive metastore (pre-2.x thrift definitions) behind a newer Presto client; third-party metastore services (e.g. AWS Glue bridge, Waggle Dance) that don't populate the success field; GRANT statements run against a mismatched metastore version.

Related errors

• Failed connecting to Hive metastore: ${addresses}
• HIVE_METASTORE_ERROR
• TTransportException
• Unsupported bucket function type
• GENERIC_INTERNAL_ERROR

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/a78fafedbd4e610e. Report an issue: GitHub.