puppetlabs/puppet · error · ArgumentError

Not authorized to call %{method} on %{description}

Error message

Not authorized to call %{method} on %{description}

What it means

Indirection#prepare calls check_authorization before each request; if the chosen terminus defines authorized? and it returns false, ArgumentError 'Not authorized to call <method> on <description>' is raised (with 'with <options>' appended when request options are present). REST/fileserver termini implement authorized? from the server's authorization config (legacy auth.conf or Puppet Server auth rules), so ACL denials surface through this raise - note it is an ArgumentError, not a Puppet::Error.

Source

Thrown at lib/puppet/indirector/indirection.rb:352

  # Check authorization if there's a hook available; fail if there is one
  # and it returns false.
  def check_authorization(request, terminus)
    # At this point, we're assuming authorization makes no sense without
    # client information.
    return unless request.node

    # This is only to authorize via a terminus-specific authorization hook.
    return unless terminus.respond_to?(:authorized?)

    unless terminus.authorized?(request)
      msg = if request.options.empty?
              _("Not authorized to call %{method} on %{description}") %
                { method: request.method, description: request.description }
            else
              _("Not authorized to call %{method} on %{description} with %{option}") %
                { method: request.method, description: request.description, option: request.options.inspect }
            end
      raise ArgumentError, msg
    end
  end

  # Pick the appropriate terminus, check the request's authorization, and return it.
  # @param [Puppet::Indirector::Request] request instance
  # @return [Puppet::Indirector::Terminus] terminus instance (usually a subclass
  #   of Puppet::Indirector::Terminus) for this request
  def prepare(request)
    # Pick our terminus.
    terminus_name = terminus_class

    dest_terminus = terminus(terminus_name)
    check_authorization(request, dest_terminus)
    dest_terminus.validate(request)

    dest_terminus
  end

View on GitHub (pinned to e227c27540)

Solutions

1. Inspect the server's authorization rules (legacy /etc/puppetlabs/puppet/auth.conf or Puppet Server conf.d/auth.conf hocon) and add an allow rule matching the client certname for the denied path.
2. Check rule ordering - first match wins; make sure your allow precedes broader deny rules.
3. Verify the client certname (puppet agent --configprint certname) against the allow pattern, remembering '.' is a regex wildcard.
4. Reload/restart Puppet Server after rule changes and retry with 'puppet agent --test' for verbose output.

Example fix

# legacy auth.conf - before
path /file_metadata
auth yes
deny *

# after
path /file_metadata
auth yes
allow *.example.com

terminus = indirection.terminus(indirection.terminus_class)
req = indirection.request(:find, key, nil, options)
if terminus.respond_to?(:authorized?) && !terminus.authorized?(req)
  raise ArgumentError, 'request would be denied by authorization rules'
end

begin
  indirection.find(key, options)
rescue ArgumentError => e
  raise if e.message !~ /Not authorized to call/
  handle_acl_denial(e) # operator action: fix allow rules
end

When it happens

Trigger: An agent requesting a fileserver mount whose allow list does not match its certname; REST calls (file_metadata/file_content finds, report upload, node save) denied by auth.conf path rules; requests from a certificate renamed after the allow rules were written.

Common situations: New nodes not added to allow directives; regex metacharacters in certnames breaking allow patterns; legacy auth.conf rule order shadowing an allow; Puppet Server hocon auth rules missing the /puppet/v3 path for an endpoint.

Related errors

• HTTP REST queries cannot handle values of type '%{klass}'
• Listing remote file buckets is not allowed
• Find %{uri} resulted in 404 with the message: %{body}
• Failed to get volume information
• Invalid SID

AI-assisted analysis of puppetlabs/puppet@e227c27540 (2026-08-21). Data as JSON: /api/errors/10f69c504ab13dab. Report an issue: GitHub.