prestodb/presto · error · IllegalArgumentException

Unsupported privilege name:

Error message

Unsupported privilege name: 

What it means

This mapping (part of fromMetastoreApiPrivilegeInfo) translates a Hive Metastore privilege name string into Presto HivePrivilegeInfo privileges. Only SELECT, UPDATE, DELETE, INSERT, OWNERSHIP (the set handled by the switch) are recognized; any other privilege name stored in the Metastore hits the default branch and throws IllegalArgumentException. This surfaces when reading grant entries from the Metastore that Presto does not model.

Solutions

1. Remove or rewrite unsupported privilege entries in the Metastore to supported ones (SELECT/INSERT/UPDATE/DELETE/OWNERSHIP)
2. Re-grant using standard Hive/SQL privileges recognized by Presto
3. Skip privilege listing for affected tables or filter at the security layer
4. Upgrade Presto to a version whose privilege mapping includes the offending name

Example fix

-- before (Hive legacy grant)
GRANT ALL ON t TO USER bob;
-- after
GRANT SELECT ON t TO USER bob;
GRANT INSERT ON t TO USER bob;

Set<String> SUPPORTED = ImmutableSet.of("SELECT","INSERT","UPDATE","DELETE","OWNERSHIP");
// filter metastore privilege entries before conversion
if (!SUPPORTED.contains(name.toUpperCase(Locale.ROOT))) {
    log.warn("Skipping unsupported privilege '%s' on %s", name, tableName);
    return ImmutableSet.of();
}

boolean isSupportedPrivilege(String name) {
    return name != null && SUPPORTED_PRIVILEGES.contains(name.toUpperCase(Locale.ROOT));
}

try {
    grants = ThriftMetastoreUtil.fromMetastoreApiPrivilegeGrantInfo(info, ...);
} catch (IllegalArgumentException e) {
    if (e.getMessage().startsWith("Unsupported privilege name")) {
        log.warn("Ignoring metastore privilege not modeled by Presto: %s", e.getMessage());
        return ImmutableSet.of();
    }
    throw e;
}

When it happens

Trigger: Listing privileges for a table where the Metastore contains a privilege name outside the supported set (e.g. 'ALL', 'INDEX', 'ALTER', 'METADATA', or Ranger/custom privilege strings) — encountered during SHOW GRANTS or access-control checks that enumerate Metastore privileges.

Common situations: Privileges granted via Hive CLI with legacy names ('ALL', 'ALTER'); ACLs written by third-party authorization systems; Hive version with additional built-in privileges.

Related errors

• Cannot grant privilege
• ACCESS_DENIED
• Cannot call procedure
• Cannot create role
• Cannot create view

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/44d01265c492c193. Report an issue: GitHub.

Appendix: source

Thrown at presto-hive-metastore/src/main/java/com/facebook/presto/hive/metastore/thrift/ThriftMetastoreUtil.java:753

        String name = userGrant.getPrivilege().toUpperCase(ENGLISH);
        PrestoPrincipal grantor = new PrestoPrincipal(fromMetastoreApiPrincipalType(userGrant.getGrantorType()), userGrant.getGrantor());
        switch (name) {
            case "ALL":
                return Arrays.stream(HivePrivilegeInfo.HivePrivilege.values())
                        .map(hivePrivilege -> new HivePrivilegeInfo(hivePrivilege, withGrantOption, grantor, grantee.orElse(grantor)))
                        .collect(toImmutableSet());
            case "SELECT":
                return ImmutableSet.of(new HivePrivilegeInfo(SELECT, withGrantOption, grantor, grantee.orElse(grantor)));
            case "INSERT":
                return ImmutableSet.of(new HivePrivilegeInfo(INSERT, withGrantOption, grantor, grantee.orElse(grantor)));
            case "UPDATE":
                return ImmutableSet.of(new HivePrivilegeInfo(UPDATE, withGrantOption, grantor, grantee.orElse(grantor)));
            case "DELETE":
                return ImmutableSet.of(new HivePrivilegeInfo(DELETE, withGrantOption, grantor, grantee.orElse(grantor)));
            case "OWNERSHIP":
                return ImmutableSet.of(new HivePrivilegeInfo(OWNERSHIP, withGrantOption, grantor, grantee.orElse(grantor)));
            default:
                throw new IllegalArgumentException("Unsupported privilege name: " + name);
        }
    }

    public static ColumnStatisticsObj createMetastoreColumnStatistics(String columnName, HiveType columnType, HiveColumnStatistics statistics, OptionalLong rowCount)
    {
        TypeInfo typeInfo = columnType.getTypeInfo();
        checkArgument(typeInfo.getCategory() == PRIMITIVE, "unsupported type: %s", columnType);
        switch (((PrimitiveTypeInfo) typeInfo).getPrimitiveCategory()) {
            case BOOLEAN:
                return createBooleanStatistics(columnName, columnType, statistics);
            case BYTE:
            case SHORT:
            case INT:
            case LONG:
                return createLongStatistics(columnName, columnType, statistics);
            case FLOAT:
            case DOUBLE:
                return createDoubleStatistics(columnName, columnType, statistics);

View on GitHub (pinned to 55bb57d202)