prestodb/presto · error · AccessDeniedException

Hive Connector does not support WITH ADMIN statement

Error message

Hive Connector does not support WITH ADMIN statement

What it means

The SQL-standard access controller reports that role-management statements carrying the WITH ADMIN OPTION clause are beyond what the Hive connector's authorization model can enforce. It fires when a check call on a role-granting statement reaches a code path (e.g. checkCanCreateRole) that does not implement WITH ADMIN semantics, acting as a NOT_SUPPORTED guard.

Source

Thrown at presto-hive/src/main/java/com/facebook/presto/hive/security/SqlStandardAccessControl.java:504

    @Override
    public void checkCanRevokeTablePrivilege(ConnectorTransactionHandle transaction, ConnectorIdentity identity, AccessControlContext context, Privilege privilege, SchemaTableName tableName, PrestoPrincipal revokee, boolean grantOptionFor)
    {
        MetastoreContext metastoreContext = createMetastoreContext(identity, context);
        if (isTableOwner(transaction, identity, metastoreContext, tableName)) {
            return;
        }

        if (!hasGrantOptionForPrivilege(transaction, identity, metastoreContext, privilege, tableName)) {
            denyRevokeTablePrivilege(privilege.name(), tableName.toString());
        }
    }

    @Override
    public void checkCanCreateRole(ConnectorTransactionHandle transactionHandle, ConnectorIdentity identity, AccessControlContext context, String role, Optional<PrestoPrincipal> grantor)
    {
        // currently specifying grantor is supported by metastore, but it is not supported by Hive itself
        if (grantor.isPresent()) {
            throw new AccessDeniedException("Hive Connector does not support WITH ADMIN statement");
        }
        MetastoreContext metastoreContext = createMetastoreContext(identity, context);
        if (!isAdmin(transactionHandle, identity, metastoreContext)) {
            denyCreateRole(role);
        }
    }

    @Override
    public void checkCanDropRole(ConnectorTransactionHandle transactionHandle, ConnectorIdentity identity, AccessControlContext context, String role)
    {
        MetastoreContext metastoreContext = createMetastoreContext(identity, context);
        if (!isAdmin(transactionHandle, identity, metastoreContext)) {
            denyDropRole(role);
        }
    }

    @Override
    public void checkCanGrantRoles(ConnectorTransactionHandle transactionHandle, ConnectorIdentity identity, AccessControlContext context, Set<String> roles, Set<PrestoPrincipal> grantees, boolean withAdminOption, Optional<PrestoPrincipal> grantor, String catalogName)

View on GitHub (pinned to 55bb57d202)

Solutions

1. Rewrite the statement without the WITH ADMIN OPTION clause
2. Perform role administration directly in the Hive metastore or with Hive tooling instead of via Presto

When it happens

Trigger: Thrown at presto-hive/src/main/java/com/facebook/presto/hive/security/SqlStandardAccessControl.java:504 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/c36801a0c0361bad. Report an issue: GitHub.