prestodb/presto · critical · PrestoException

HIVE_RANGER_SERVER_ERROR

HIVE_RANGER_SERVER_ERROR

Error message

Unable to fetch policy information from ranger

What it means

RangerAuthorizer could not retrieve the cached Ranger ServicePolicies; the Future (servicePolicies.get()) threw, wrapped as a PrestoException with HIVE_RANGER_SERVER_ERROR. This usually reflects the underlying Ranger admin REST call failing or the policy-refresh background task erroring.

Source

Thrown at presto-hive/src/main/java/com/facebook/presto/hive/security/ranger/RangerAuthorizer.java:104

        plugin.setResultProcessor(new RangerDefaultAuditHandler());
    }

    private void updateRangerPolicies()
    {
        ServicePolicies newServicePolicies = getRangerServicePolicies();
        ServicePolicies existingServicePolicies = currentServicePolicies.get();
        if (newServicePolicies != existingServicePolicies && currentServicePolicies.compareAndSet(existingServicePolicies, newServicePolicies)) {
            plugin.setPolicies(newServicePolicies);
        }
    }

    private ServicePolicies getRangerServicePolicies()
    {
        try {
            return servicePolicies.get();
        }
        catch (Exception ex) {
            throw new PrestoException(HIVE_RANGER_SERVER_ERROR, "Unable to fetch policy information from ranger", ex);
        }
    }

    public boolean authorizeHiveResource(String database, String table, String column, String accessType, String user, Set<String> userGroups, Set<String> userRoles)
    {
        updateRangerPolicies();
        RangerAccessResourceImpl resource = new RangerAccessResourceImpl();
        if (!isNullOrEmpty(database)) {
            resource.setValue(KEY_DATABASE, database);
        }

        if (!isNullOrEmpty(table)) {
            resource.setValue(KEY_TABLE, table);
        }

        if (!isNullOrEmpty(column)) {
            resource.setValue(KEY_COLUMN, column);
        }

View on GitHub (pinned to 55bb57d202)

Solutions

1. Verify the Ranger admin endpoint is reachable (curl the ranger.http.end-point from the coordinator)
2. Check Ranger admin service health, auth credentials and plugin logs
3. Fix the underlying exception (chained as the cause) — network, HTTP status, or JSON parse errors
4. Restart the Presto coordinator so the policy-refresh task is re-established
5. Increase refreshPeriod or retry tolerance if Ranger is intermittently slow

Example fix

// before (config)
ranger.http.end-point=http://ranger-old:6080
// after
ranger.http.end-point=http://ranger-admin.example.com:6080

// preflight: check Ranger admin health before issuing queries
int status = httpHead(rangerEndPoint + "/service/plugins/policies").getStatusCode();
if (status != 200) throw new IllegalStateException("Ranger admin unavailable");

try {
    runQuery();
} catch (PrestoException e) {
    if ("HIVE_RANGER_SERVER_ERROR".equals(e.getErrorCode().getName())
            && e.getMessage().contains("Unable to fetch policy information")) {
        // alert on Ranger availability, backoff and retry
    } else throw e;
}

When it happens

Trigger: authorizeHiveResource / updateRangerPolicies calls getRangerServicePolicies while the policy Future has failed — e.g. Ranger admin unreachable, HTTP error, auth failure, or malformed policy response.

Common situations: Ranger admin service down or restarted; wrong ranger.http.end-point; network/firewall between Presto and Ranger; expired Ranger auth credentials; stale failed Future after a Ranger outage.

Related errors

• Unable to query ranger service
• HIVE_RANGER_SERVER_ERROR
• Hive Connector does not support GRANTED BY statement
• HIVE_CORRUPTED_COLUMN_STATISTICS
• Unsupported privilege name:

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/ef6721c793b0bc32. Report an issue: GitHub.