weaviate/weaviate · error

filtering authorized namespaces: %w

Error message

filtering authorized namespaces: %w

What it means

This error wraps a failure of h.authorizer.FilterAuthorizedResources, which filters the namespace list down to resources the principal may READ. It surfaces as a 500 because authorization filtering itself failed (as opposed to the request being denied), typically an internal problem in the authz plugin/RBAC store.

Source

Thrown at adapters/handlers/rest/namespaces/handlers_namespaces.go:405

	all, err := h.raft.GetNamespaces()
	if err != nil {
		return nsops.NewListNamespacesInternalServerError().WithPayload(
			cerrors.ErrPayloadFromSingleErr(principal, fmt.Errorf("listing namespaces: %w", err)))
	}
	if len(all) == 0 {
		return nsops.NewListNamespacesOK().WithPayload([]*models.Namespace{})
	}

	resources := make([]string, len(all))
	for i, ns := range all {
		resources[i] = authorization.Namespaces(ns.Name)[0]
	}

	allowed, err := h.authorizer.FilterAuthorizedResources(ctx, principal, authorization.READ, resources...)
	if err != nil {
		return nsops.NewListNamespacesInternalServerError().WithPayload(
			cerrors.ErrPayloadFromSingleErr(principal, fmt.Errorf("filtering authorized namespaces: %w", err)))
	}

	allowedSet := make(map[string]struct{}, len(allowed))
	for _, r := range allowed {
		allowedSet[r] = struct{}{}
	}

	out := make([]*models.Namespace, 0, len(allowed))
	for _, ns := range all {
		if _, ok := allowedSet[authorization.Namespaces(ns.Name)[0]]; ok {
			out = append(out, &models.Namespace{Name: ns.Name, HomeNode: ns.Primary(), State: string(ns.State)})
		}
	}
	return nsops.NewListNamespacesOK().WithPayload(out)
}

View on GitHub (pinned to 75aa4b6d11)

Solutions

1. Verify the authorizer module configuration (AUTHORIZATION_* env vars) and that its backend is reachable
2. Check server logs for the underlying error wrapped after 'filtering authorized namespaces:'
3. Confirm the principal's roles exist in the RBAC state and re-sync roles if needed
4. Temporarily test with an admin principal to isolate whether the issue is role-specific

// Ensure a principal is resolvable before listing
if principal == nil || principal.Username == "" { return errors.New("authenticated principal required") }

ns, err := client.Namespaces.List(ctx)
if err != nil {
    var apiErr *namespaces.ListNamespacesInternalServerError
    if errors.As(err, &apiErr) { log.Printf("authz filter failed: %s", apiErr.Payload.Error[0].Message) }
    return err
}

When it happens

Trigger: GET /v1/namespaces with RBAC authorization enabled when the authorizer errors: configured authz module failed to initialize, user/role lookup fails, or an external authz backend is unreachable.

Common situations: AUTHORIZATION_CONFIG set to a module that cannot reach its backend; RBAC roles deleted or corrupted while a valid JWT is presented; misconfigured OIDC groups mapping.

Related errors

• a namespace-local role can only be assigned by an administra
• DeleteRoles: %w
• AddRolesForUser: %w
• NAMESPACES_ENABLED=true requires RBAC to be enabled
• insufficient permissions to view role

AI-assisted analysis of weaviate/weaviate@75aa4b6d11 (2026-09-04). Data as JSON: /api/errors/0d1bd5729e3550bd. Report an issue: GitHub.