prestodb/presto · error · AccessDeniedException

Hive Connector does not support GRANTED BY statement

Error message

Hive Connector does not support GRANTED BY statement

What it means

The Hive connector's SQL-standard access control rejects GRANT ROLE statements that include a GRANTED BY clause. While the Hive metastore can store a grantor, Hive itself does not support specifying one, so checkCanGrantRoles throws AccessDeniedException before any metastore call is made.

Source

Thrown at presto-hive/src/main/java/com/facebook/presto/hive/security/SqlStandardAccessControl.java:526

            denyCreateRole(role);
        }
    }

    @Override
    public void checkCanDropRole(ConnectorTransactionHandle transactionHandle, ConnectorIdentity identity, AccessControlContext context, String role)
    {
        MetastoreContext metastoreContext = createMetastoreContext(identity, context);
        if (!isAdmin(transactionHandle, identity, metastoreContext)) {
            denyDropRole(role);
        }
    }

    @Override
    public void checkCanGrantRoles(ConnectorTransactionHandle transactionHandle, ConnectorIdentity identity, AccessControlContext context, Set<String> roles, Set<PrestoPrincipal> grantees, boolean withAdminOption, Optional<PrestoPrincipal> grantor, String catalogName)
    {
        // currently specifying grantor is supported by metastore, but it is not supported by Hive itself
        if (grantor.isPresent()) {
            throw new AccessDeniedException("Hive Connector does not support GRANTED BY statement");
        }
        MetastoreContext metastoreContext = createMetastoreContext(identity, context);
        if (!hasAdminOptionForRoles(transactionHandle, identity, metastoreContext, roles)) {
            denyGrantRoles(roles, grantees);
        }
    }

    @Override
    public void checkCanRevokeRoles(ConnectorTransactionHandle transactionHandle, ConnectorIdentity identity, AccessControlContext context, Set<String> roles, Set<PrestoPrincipal> grantees, boolean adminOptionFor, Optional<PrestoPrincipal> grantor, String catalogName)
    {
        // currently specifying grantor is supported by metastore, but it is not supported by Hive itself
        if (grantor.isPresent()) {
            throw new AccessDeniedException("Hive Connector does not support GRANTED BY statement");
        }
        MetastoreContext metastoreContext = createMetastoreContext(identity, context);
        if (!hasAdminOptionForRoles(transactionHandle, identity, metastoreContext, roles)) {
            denyRevokeRoles(roles, grantees);
        }

View on GitHub (pinned to 55bb57d202)

Solutions

1. Remove the GRANTED BY clause from the GRANT ROLE statement
2. Run the grant as the intended grantor user instead of using GRANTED BY
3. Use a connector/access-control that supports grantor specification (e.g. system-level access control or a different catalog)

Example fix

// before
GRANT admin TO USER alice GRANTED BY USER bob;
// after
GRANT admin TO USER alice;

// before submitting DDL against a Hive catalog
if (grantSql.toLowerCase().contains("granted by")) {
    throw new IllegalArgumentException("Hive connector does not support GRANTED BY");
}

try {
    executeGrant(sql);
} catch (AccessDeniedException e) {
    if (e.getMessage().contains("GRANTED BY")) {
        executeGrant(sql.replaceAll("(?i)granted\\s+by\\s+\\S+\\s+USER\\s+\\S+", "").trim());
    } else throw e;
}

When it happens

Trigger: Executing GRANT role TO principal GRANTED BY grantor against a Hive catalog, which reaches SqlStandardAccessControl.checkCanGrantRoles with grantor present.

Common situations: Tools or migration scripts generated for other catalogs (e.g. Postgres-style grants) that always emit GRANTED BY; BI/admin tools adding the clause by default; replicated DDL from another engine.

Related errors

• HIVE_RANGER_SERVER_ERROR
• PERMISSION_DENIED
• Unsupported privilege name:
• Cannot set catalog session property:
• Cannot show role grants from catalog %s

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/4fbf4bba84080c6f. Report an issue: GitHub.