vitessio/vitess · error

aclFactory for given default: %s is not found

Error message

aclFactory for given default: %s is not found

What it means

GetCurrentACLFactory resolves the configured default ACL factory by name from the set of registered factories. If the configured default does not match any registered factory name, lookup fails and this error is returned.

Source

Thrown at go/vt/tableacl/tableacl.go:320

// GetCurrentACLFactory returns current table acl implementation.
func GetCurrentACLFactory() (acl.Factory, error) {
	mu.Lock()
	defer mu.Unlock()
	if len(acls) == 0 {
		return nil, errors.New("no AclFactories registered")
	}
	if defaultACL == "" {
		if len(acls) == 1 {
			for _, aclFactory := range acls {
				return aclFactory, nil
			}
		}
		return nil, errors.New("there are more than one AclFactory registered but no default has been given")
	}
	if aclFactory, ok := acls[defaultACL]; ok {
		return aclFactory, nil
	}
	return nil, fmt.Errorf("aclFactory for given default: %s is not found", defaultACL)
}

View on GitHub (pinned to 01a25a7d17)

Solutions

1. Check the configured default ACL name against registered factories (simple, json, etc.)
2. Fix the config flag/tableacl config value to a registered factory name
3. Ensure the package providing the factory is imported/registered before use
4. If you only want one factory registered, deregister others or set the default explicitly

Example fix

// before: default 'Ldap' never registered
tableacl.Init(...defaultACL="Ldap")
// after: use a registered factory or register yours
tableacl.RegisterACLFactory("Ldap", myFactory) // or defaultACL="Simple"

if tableacl.GetCurrentACLFactoryCount() > 1 && defaultACL == "" {
    return errors.New("set a default ACL factory name")
}
// confirm the name is registered before resolving
if !tableacl.IsRegistered(defaultACL) {
    return fmt.Errorf("unknown ACL factory %q", defaultACL)
}

factory, err := tableacl.GetCurrentACLFactory()
if err != nil {
    return fmt.Errorf("check --queryserver-config-acl-exempt-acl / tableacl default: %w", err)
}

When it happens

Trigger: Calling tableacl.GetCurrentACLFactory (directly or via NewQueryEngine) when --queryserver-config-acl-exempt-acl or tableacl default config names a factory that was never registered via RegisterACLFactory.

Common situations: Typo in the ACL default name (e.g. 'simple' vs 'Simple'), setting a default in config without importing the package that registers that factory, or an empty default while multiple factories are registered (different 'more than one' error).

Related errors

• conflicting entries: %q overlaps with %q
• unknown vtctl client protocol: %v
• unknown vtctld client protocol: %s
• --s3-backup-storage-bucket required
• direct DDL is disabled

AI-assisted analysis of vitessio/vitess@01a25a7d17 (2026-09-01). Data as JSON: /api/errors/e12b260145fc0f76. Report an issue: GitHub.