prestodb/presto · warning · AccessDeniedException

User [%s] not a member of the authorized group

Error message

User [%s] not a member of the authorized group

What it means

Thrown by LdapAuthenticator.checkForGroupMembership when the LDAP search for the user in the authorized group completes successfully but returns no results (search.hasMoreElements() is false). The user authenticated (or the search ran) but is not a member of the group configured via presto.password.authenticator.ldap group-authentication settings, so access is denied with AccessDeniedException.

Source

Thrown at presto-password-authenticators/src/main/java/com/facebook/presto/password/ldap/LdapAuthenticator.java:168

        String searchFilter = replaceUser(groupAuthorizationSearchPattern.get(), user);
        SearchControls searchControls = new SearchControls();
        searchControls.setSearchScope(SearchControls.SUBTREE_SCOPE);

        boolean authorized;
        try {
            NamingEnumeration<SearchResult> search = context.search(userBase, searchFilter, searchControls);
            authorized = search.hasMoreElements();
            search.close();
        }
        catch (NamingException e) {
            log.debug("Authentication error for user [%s]: %s", user, e.getMessage());
            throw new RuntimeException("Authentication error");
        }

        if (!authorized) {
            String message = format("User [%s] not a member of the authorized group", user);
            log.debug(message);
            throw new AccessDeniedException(message);
        }
    }

    private static String replaceUser(String pattern, String user)
    {
        return pattern.replaceAll("\\$\\{USER}", user);
    }

    private static void closeContext(DirContext context)
    {
        try {
            context.close();
        }
        catch (NamingException ignored) {
        }
    }

    private static class Credentials

View on GitHub (pinned to 55bb57d202)

Solutions

1. Confirm the user is actually a member of the required group: run ldapsearch with the same group filter and base DN the connector uses
2. Check that ldap.group-base-dn and ldap.group-authentication-search-filter match your directory schema (member vs memberOf, correct objectClass)
3. If nested groups are needed, use a filter that supports transitive membership (e.g. LDAP_MATCHING_RULE_IN_CHAIN member:1.2.840.113556.1.4.1941:= on AD) or add the user to the direct group
4. Ask the directory admin to add the user to the authorized group
5. If group checks are not desired, remove the group-authentication properties so only password auth is enforced

Example fix

// before (wrong attribute for directory)
ldap.group-authentication-search-filter=(&(objectClass=groupOfNames)(member=${USER}))
// after (memberOf attribute on the user entry)
ldap.group-authentication-search-filter=(&(objectClass=group)(memberOf=cn=presto-admins,ou=groups,dc=example,dc=com))

# Verify group membership with the exact configured base and filter before attempting login
ldapsearch -x -H ldaps://ldap.example.com:636 -D 'cn=svc,dc=example,dc=com' -W \
  -b 'ou=groups,dc=example,dc=com' \
  '(&(objectClass=groupOfNames)(member=uid=testuser,ou=people,dc=example,dc=com))' dn

try {
  ldapAuthenticator.authenticate(user, password);
} catch (AccessDeniedException e) {
  // message: 'User [x] not a member of the authorized group'
  throw new AuthenticationException("Not authorized: you must be a member of the required LDAP group");
}

When it happens

Trigger: checkForGroupMembership performs context.search(userBase, searchFilter, searchControls) and the result enumeration is empty: the user DN does not match searchFilter, the user is not in the required LDAP group, or groupBase/groupAuthSearchFilter point at the wrong subtree.

Common situations: User removed from the required LDAP group (e.g. after team change); group-authentication-search-filter or group-base-dn misconfigured so membership is searched in the wrong subtree; nested groups not matched because LDAP does not expand them with the configured filter (missing objectClass:groupOfNames nesting support); using member vs memberOf attribute mismatch.

Related errors

• Cannot set role %s
• Invalid credentials
• Cannot set catalog session property:
• ACCESS_DENIED
• Cannot rename a column in table %s%s

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/2a8d98d5b59e1f3b. Report an issue: GitHub.