prestodb/presto · error · IllegalArgumentException

Unsupported principal type:

Error message

Unsupported principal type: 

What it means

ThriftMetastoreUtil.toMetastoreApiPrincipalType maps Presto's PrincipalType (USER, ROLE) to the Hive metastore API PrincipalType. Presto only defines USER and ROLE; the default branch throws IllegalArgumentException("Unsupported principal type: " + principalType) because there is no Hive equivalent for the value (typically GROUP).

Source

Thrown at presto-hive-metastore/src/main/java/com/facebook/presto/hive/metastore/thrift/ThriftMetastoreUtil.java:220

    public static PrivilegeGrantInfo toMetastoreApiPrivilegeGrantInfo(HivePrivilegeInfo privilegeInfo)
    {
        return new PrivilegeGrantInfo(
                privilegeInfo.getHivePrivilege().name().toLowerCase(Locale.ENGLISH),
                0,
                privilegeInfo.getGrantor().getName(),
                fromPrestoPrincipalType(privilegeInfo.getGrantor().getType()),
                privilegeInfo.isGrantOption());
    }

    public static org.apache.hadoop.hive.metastore.api.PrincipalType toMetastoreApiPrincipalType(PrincipalType principalType)
    {
        switch (principalType) {
            case USER:
                return org.apache.hadoop.hive.metastore.api.PrincipalType.USER;
            case ROLE:
                return org.apache.hadoop.hive.metastore.api.PrincipalType.ROLE;
            default:
                throw new IllegalArgumentException("Unsupported principal type: " + principalType);
        }
    }

    public static Stream<RoleGrant> listApplicableRoles(PrestoPrincipal principal, Function<PrestoPrincipal, Set<RoleGrant>> listRoleGrants)
    {
        Queue<PrestoPrincipal> queue = new ArrayDeque<>();
        queue.add(principal);
        Queue<RoleGrant> output = new ArrayDeque<>();
        Set<RoleGrant> seenRoles = new HashSet<>();
        return Streams.stream(new AbstractIterator<RoleGrant>()
        {
            @Override
            protected RoleGrant computeNext()
            {
                if (!output.isEmpty()) {
                    return output.remove();
                }
                if (queue.isEmpty()) {

View on GitHub (pinned to 55bb57d202)

Solutions

1. Find the PrestoPrincipal being mapped and change its type to USER or ROLE before invoking the metastore call.
2. If a table owner is stored as GROUP (legacy Hive-managed privilege), migrate the ownership/privileges to a USER or ROLE principal (ALTER TABLE ... SET / Hive-side re-grants).
3. Extend the switch (in a fork) to map GROUP to org.apache.hadoop.hive.metastore.api.PrincipalType.GROUP if the target metastore supports it.
4. Audit where principals originate (authorization identity providers) and reject GROUP principals at the connector boundary.

Example fix

// before
PrestoPrincipal owner = new PrestoPrincipal(GROUP, groupName);
metastore.createDatabase(..., toMetastoreApiDatabase(owner, ...));
// after
PrestoPrincipal owner = new PrestoPrincipal(USER, userName);
if (owner.getType() != USER && owner.getType() != ROLE) {
    throw new IllegalArgumentException("Principal must be USER or ROLE: " + owner.getType());
}
metastore.createDatabase(..., toMetastoreApiDatabase(owner, ...));

// validate principal type before any metastore mapping call
public static void requireSupportedPrincipal(PrestoPrincipal principal) {
    checkArgument(principal.getType() == PrincipalType.USER
            || principal.getType() == PrincipalType.ROLE,
        "Unsupported principal type for metastore: %s", principal.getType());
}

public static boolean isMetastoreSupportedPrincipal(PrestoPrincipal principal) {
    return principal.getType() == PrincipalType.USER
        || principal.getType() == PrincipalType.ROLE;
}
// usage: if (isMetastoreSupportedPrincipal(principal)) { ... } else { fail fast with clear message }

try {
    toMetastoreApiDatabase(principal, ...);
}
catch (IllegalArgumentException e) {
    if (e.getMessage().startsWith("Unsupported principal type")) {
        throw new PrestoException(NOT_SUPPORTED, "GROUP principals are not supported by the Hive metastore mapping", e);
    }
    throw e;
}

When it happens

Trigger: Calling toMetastoreApiDatabase (or other toMetastoreApi* callers) with a PrestoPrincipal whose type is not USER or ROLE — e.g. a PrestoPrincipal of type GROUP constructed from a table-grant owner or authorization identity, passed into metadata APIs that convert it for the metastore.

Common situations: Hive connector operating on a table whose owner/privileges were recorded as a GROUP principal (possible when Hive-native authorization stored group grants); custom connectors or code building PrestoPrincipal(GROUP, ...) and calling metastore mapping; session/function authorization identities resolving to GROUP.

Related errors

• Invalid day-time interval:
• Invalid year-month interval:
• dictionarySourceIds must be the same
• blocks is empty
• Column does not have same position count (%s) as page (%s)

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/b537db6f3225bd67. Report an issue: GitHub.