prestodb/presto · error · IllegalArgumentException

Unsupported privilege name:

Error message

Unsupported privilege name:

What it means

This mapping (part of fromMetastoreApiPrivilegeInfo) translates a Hive Metastore privilege name string into Presto HivePrivilegeInfo privileges. Only SELECT, UPDATE, DELETE, INSERT, OWNERSHIP (the set handled by the switch) are recognized; any other privilege name stored in the Metastore hits the default branch and throws IllegalArgumentException. This surfaces when reading grant entries from the Metastore that Presto does not model.

Source

Thrown at presto-hive-metastore/src/main/java/com/facebook/presto/hive/metastore/thrift/ThriftMetastoreUtil.java:753

        String name = userGrant.getPrivilege().toUpperCase(ENGLISH);
        PrestoPrincipal grantor = new PrestoPrincipal(fromMetastoreApiPrincipalType(userGrant.getGrantorType()), userGrant.getGrantor());
        switch (name) {
            case "ALL":
                return Arrays.stream(HivePrivilegeInfo.HivePrivilege.values())
                        .map(hivePrivilege -> new HivePrivilegeInfo(hivePrivilege, withGrantOption, grantor, grantee.orElse(grantor)))
                        .collect(toImmutableSet());
            case "SELECT":
                return ImmutableSet.of(new HivePrivilegeInfo(SELECT, withGrantOption, grantor, grantee.orElse(grantor)));
            case "INSERT":
                return ImmutableSet.of(new HivePrivilegeInfo(INSERT, withGrantOption, grantor, grantee.orElse(grantor)));
            case "UPDATE":
                return ImmutableSet.of(new HivePrivilegeInfo(UPDATE, withGrantOption, grantor, grantee.orElse(grantor)));
            case "DELETE":
                return ImmutableSet.of(new HivePrivilegeInfo(DELETE, withGrantOption, grantor, grantee.orElse(grantor)));
            case "OWNERSHIP":
                return ImmutableSet.of(new HivePrivilegeInfo(OWNERSHIP, withGrantOption, grantor, grantee.orElse(grantor)));
            default:
                throw new IllegalArgumentException("Unsupported privilege name: " + name);
        }
    }

    public static ColumnStatisticsObj createMetastoreColumnStatistics(String columnName, HiveType columnType, HiveColumnStatistics statistics, OptionalLong rowCount)
    {
        TypeInfo typeInfo = columnType.getTypeInfo();
        checkArgument(typeInfo.getCategory() == PRIMITIVE, "unsupported type: %s", columnType);
        switch (((PrimitiveTypeInfo) typeInfo).getPrimitiveCategory()) {
            case BOOLEAN:
                return createBooleanStatistics(columnName, columnType, statistics);
            case BYTE:
            case SHORT:
            case INT:
            case LONG:
                return createLongStatistics(columnName, columnType, statistics);
            case FLOAT:
            case DOUBLE:
                return createDoubleStatistics(columnName, columnType, statistics);

View on GitHub (pinned to 55bb57d202)

Solutions

  1. Remove or rewrite unsupported privilege entries in the Metastore to supported ones (SELECT/INSERT/UPDATE/DELETE/OWNERSHIP)
  2. Re-grant using standard Hive/SQL privileges recognized by Presto
  3. Skip privilege listing for affected tables or filter at the security layer
  4. Upgrade Presto to a version whose privilege mapping includes the offending name

Example fix

-- before (Hive legacy grant)
GRANT ALL ON t TO USER bob;
-- after
GRANT SELECT ON t TO USER bob;
GRANT INSERT ON t TO USER bob;
Defensive patterns

Strategy: try-catch

Validate before calling

Set<String> SUPPORTED = ImmutableSet.of("SELECT","INSERT","UPDATE","DELETE","OWNERSHIP");
// filter metastore privilege entries before conversion
if (!SUPPORTED.contains(name.toUpperCase(Locale.ROOT))) {
    log.warn("Skipping unsupported privilege '%s' on %s", name, tableName);
    return ImmutableSet.of();
}

Type guard

boolean isSupportedPrivilege(String name) {
    return name != null && SUPPORTED_PRIVILEGES.contains(name.toUpperCase(Locale.ROOT));
}

Try / catch

try {
    grants = ThriftMetastoreUtil.fromMetastoreApiPrivilegeGrantInfo(info, ...);
} catch (IllegalArgumentException e) {
    if (e.getMessage().startsWith("Unsupported privilege name")) {
        log.warn("Ignoring metastore privilege not modeled by Presto: %s", e.getMessage());
        return ImmutableSet.of();
    }
    throw e;
}

Prevention

When it happens

Trigger: Listing privileges for a table where the Metastore contains a privilege name outside the supported set (e.g. 'ALL', 'INDEX', 'ALTER', 'METADATA', or Ranger/custom privilege strings) — encountered during SHOW GRANTS or access-control checks that enumerate Metastore privileges.

Common situations: Privileges granted via Hive CLI with legacy names ('ALL', 'ALTER'); ACLs written by third-party authorization systems; Hive version with additional built-in privileges.

Related errors

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/44d01265c492c193. Report an issue: GitHub.