You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@ranger.apache.org by "Fang-Yu Rao (Jira)" <ji...@apache.org> on 2026/08/04 16:47:00 UTC
[jira] [Resolved] (RANGER-5726) Ranger server returns an incorrect error message when an admin tries to revoke a non-existing role from a user
[ https://issues.apache.org/jira/browse/RANGER-5726?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Fang-Yu Rao resolved RANGER-5726.
---------------------------------
Fix Version/s: 3.0.0
Resolution: Duplicate
> Ranger server returns an incorrect error message when an admin tries to revoke a non-existing role from a user
> --------------------------------------------------------------------------------------------------------------
>
> Key: RANGER-5726
> URL: https://issues.apache.org/jira/browse/RANGER-5726
> Project: Ranger
> Issue Type: Bug
> Components: Ranger
> Reporter: Fang-Yu Rao
> Assignee: Akash Gupta
> Priority: Major
> Fix For: 3.0.0
>
>
> We found the Ranger server would return an incorrect error message when an admin tries to grant a non-existing role to a user. In what follows I provide the steps to reproduce the issue in a beeline instance connected to a version of Hive Server2.
> {code}
> # This verifies the requesting user is allowed to create a role 'role_100'.
> 0: jdbc:hive2://ccycloud-1.cdpd102205p01d06.r> create role role_100;
> INFO : Compiling command(queryId=hive_20260716191507_8f9415f3-5035-4d50-8029-ae5f8dee3ecb): create role role_100
> INFO : Semantic Analysis Completed (retrial = false)
> INFO : Created Hive schema: Schema(fieldSchemas:null, properties:null)
> INFO : Completed compiling command(queryId=hive_20260716191507_8f9415f3-5035-4d50-8029-ae5f8dee3ecb); Time taken: 0.03 seconds
> INFO : Executing command(queryId=hive_20260716191507_8f9415f3-5035-4d50-8029-ae5f8dee3ecb): create role role_100
> INFO : Starting task [Stage-0:DDL] in serial mode
> INFO : Completed executing command(queryId=hive_20260716191507_8f9415f3-5035-4d50-8029-ae5f8dee3ecb); Time taken: 0.037 seconds
> INFO : OK
> No rows affected (0.083 seconds)
> # # This verifies the role 'role_100' is dropped.
> 0: jdbc:hive2://ccycloud-1.cdpd102205p01d06.r> drop role role_100;
> INFO : Compiling command(queryId=hive_20260716191832_75c3783e-3e19-476d-a293-fd513629ddea): drop role role_100
> INFO : Semantic Analysis Completed (retrial = false)
> INFO : Created Hive schema: Schema(fieldSchemas:null, properties:null)
> INFO : Completed compiling command(queryId=hive_20260716191832_75c3783e-3e19-476d-a293-fd513629ddea); Time taken: 0.003 seconds
> INFO : Executing command(queryId=hive_20260716191832_75c3783e-3e19-476d-a293-fd513629ddea): drop role role_100
> INFO : Starting task [Stage-0:DDL] in serial mode
> INFO : Completed executing command(queryId=hive_20260716191832_75c3783e-3e19-476d-a293-fd513629ddea); Time taken: 0.043 seconds
> INFO : OK
> No rows affected (0.061 seconds)
> # # This reproduces the issue.
> 0: jdbc:hive2://ccycloud-1.cdpd102205p01d06.r> grant role role_100 to user hdfs;
> INFO : Compiling command(queryId=hive_20260716191903_17958d74-c978-47b5-bbf4-f5cee5cc16e2): grant role role_100 to user hdfs
> INFO : Semantic Analysis Completed (retrial = false)
> INFO : Created Hive schema: Schema(fieldSchemas:null, properties:null)
> INFO : Completed compiling command(queryId=hive_20260716191903_17958d74-c978-47b5-bbf4-f5cee5cc16e2); Time taken: 0.003 seconds
> INFO : Executing command(queryId=hive_20260716191903_17958d74-c978-47b5-bbf4-f5cee5cc16e2): grant role role_100 to user hdfs
> INFO : Starting task [Stage-0:DDL] in serial mode
> ERROR : Failed
> org.apache.hadoop.hive.ql.security.authorization.plugin.HiveAccessControlException: java.lang.Exception: HTTP 400 Error: User doesn't have permissions to grant
> role role_100
> at org.apache.ranger.authorization.hive.authorizer.RangerHiveAuthorizer.grantRole(RangerHiveAuthorizer.java:585) ~[ranger-hive-plugin-2.8.0.7.3.2.20000-
> 134.jar:2.8.0.7.3.2.20000-134]
> at org.apache.hadoop.hive.ql.ddl.privilege.role.grant.GrantRoleOperation.execute(GrantRoleOperation.java:53) ~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.
> 1.3000.7.3.2.20000-134]
> at org.apache.hadoop.hive.ql.ddl.DDLTask.execute(DDLTask.java:84) ~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
> at org.apache.hadoop.hive.ql.exec.Task.executeTask(Task.java:213) ~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
> at org.apache.hadoop.hive.ql.exec.TaskRunner.runSequential(TaskRunner.java:105) ~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
> at org.apache.hadoop.hive.ql.Executor.launchTask(Executor.java:354) ~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
> at org.apache.hadoop.hive.ql.Executor.launchTasks(Executor.java:327) ~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
> at org.apache.hadoop.hive.ql.Executor.runTasks(Executor.java:244) ~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
> at org.apache.hadoop.hive.ql.Executor.execute(Executor.java:105) ~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
> at org.apache.hadoop.hive.ql.Driver.execute(Driver.java:843) ~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
> at org.apache.hadoop.hive.ql.Driver.runInternal(Driver.java:695) ~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
> at org.apache.hadoop.hive.ql.Driver.run(Driver.java:536) ~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
> at org.apache.hadoop.hive.ql.Driver.run(Driver.java:530) ~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
> at org.apache.hadoop.hive.ql.reexec.ReExecDriver.run(ReExecDriver.java:190) ~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
> at org.apache.hive.service.cli.operation.SQLOperation.runQuery(SQLOperation.java:232) ~[hive-service-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-1
> 34]
> at org.apache.hive.service.cli.operation.SQLOperation$BackgroundWork$1.run(SQLOperation.java:336) ~[hive-service-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7
> .3.2.20000-134]
> at java.security.AccessController.doPrivileged(AccessController.java:712) ~[?:?]
> at javax.security.auth.Subject.doAs(Subject.java:439) ~[?:?]
> at org.apache.hadoop.security.UserGroupInformation.doAs(UserGroupInformation.java:1964) ~[hadoop-common-3.4.2.7.3.2.20000-134.jar:?]
> at org.apache.hive.service.cli.operation.SQLOperation$BackgroundWork.run(SQLOperation.java:356) ~[hive-service-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3
> .2.20000-134]
> at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:539) ~[?:?]
> at java.util.concurrent.FutureTask.run(FutureTask.java:264) ~[?:?]
> at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:539) ~[?:?]
> at java.util.concurrent.FutureTask.run(FutureTask.java:264) ~[?:?]
> at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136) ~[?:?]
> at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635) ~[?:?]
> at java.lang.Thread.run(Thread.java:840) ~[?:?]
> Caused by: java.lang.Exception: HTTP 400 Error: User doesn't have permissions to grant role role_100
> at org.apache.ranger.admin.client.RangerAdminRESTClient.grantRole(RangerAdminRESTClient.java:571) ~[ranger-plugins-common-2.8.0.7.3.2.20000-134.jar:2.8.
> 0.7.3.2.20000-134]
> ... 26 more
> ERROR : DDLTask failed, DDL Operation: class org.apache.hadoop.hive.ql.ddl.privilege.role.grant.GrantRoleOperation
> org.apache.hadoop.hive.ql.security.authorization.plugin.HiveAccessControlException: java.lang.Exception: HTTP 400 Error: User doesn't have permissions to grant role role_100
> at org.apache.ranger.authorization.hive.authorizer.RangerHiveAuthorizer.grantRole(RangerHiveAuthorizer.java:585) ~[ranger-hive-plugin-2.8.0.7.3.2.20000-134.jar:2.8.0.7.3.2.20000-134]
> at org.apache.hadoop.hive.ql.ddl.privilege.role.grant.GrantRoleOperation.execute(GrantRoleOperation.java:53) ~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
> at org.apache.hadoop.hive.ql.ddl.DDLTask.execute(DDLTask.java:84) ~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
> at org.apache.hadoop.hive.ql.exec.Task.executeTask(Task.java:213) ~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
> at org.apache.hadoop.hive.ql.exec.TaskRunner.runSequential(TaskRunner.java:105) ~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
> at org.apache.hadoop.hive.ql.Executor.launchTask(Executor.java:354) ~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
> at org.apache.hadoop.hive.ql.Executor.launchTasks(Executor.java:327) ~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
> at org.apache.hadoop.hive.ql.Executor.runTasks(Executor.java:244) ~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
> at org.apache.hadoop.hive.ql.Executor.execute(Executor.java:105) ~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
> at org.apache.hadoop.hive.ql.Driver.execute(Driver.java:843) ~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
> at org.apache.hadoop.hive.ql.Driver.runInternal(Driver.java:695) ~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
> at org.apache.hadoop.hive.ql.Driver.run(Driver.java:536) ~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
> at org.apache.hadoop.hive.ql.Driver.run(Driver.java:530) ~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
> at org.apache.hadoop.hive.ql.reexec.ReExecDriver.run(ReExecDriver.java:190) ~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
> at org.apache.hive.service.cli.operation.SQLOperation.runQuery(SQLOperation.java:232) ~[hive-service-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
> at org.apache.hive.service.cli.operation.SQLOperation$BackgroundWork$1.run(SQLOperation.java:336) ~[hive-service-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
> at java.security.AccessController.doPrivileged(AccessController.java:712) ~[?:?]
> at javax.security.auth.Subject.doAs(Subject.java:439) ~[?:?]
> at org.apache.hadoop.security.UserGroupInformation.doAs(UserGroupInformation.java:1964) ~[hadoop-common-3.4.2.7.3.2.20000-134.jar:?]
> at org.apache.hive.service.cli.operation.SQLOperation$BackgroundWork.run(SQLOperation.java:356) ~[hive-service-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
> at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:539) ~[?:?]
> at java.util.concurrent.FutureTask.run(FutureTask.java:264) ~[?:?]
> at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:539) ~[?:?]
> at java.util.concurrent.FutureTask.run(FutureTask.java:264) ~[?:?]
> at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136) ~[?:?]
> at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635) ~[?:?]
> at java.lang.Thread.run(Thread.java:840) ~[?:?]
> Caused by: java.lang.Exception: HTTP 400 Error: User doesn't have permissions to grant role role_100
> at org.apache.ranger.admin.client.RangerAdminRESTClient.grantRole(RangerAdminRESTClient.java:571) ~[ranger-plugins-common-2.8.0.7.3.2.20000-134.jar:2.8.0.7.3.2.20000-134]
> at org.apache.ranger.plugin.service.RangerBasePlugin.grantRole(RangerBasePlugin.java:1061) ~[ranger-plugins-common-2.8.0.7.3.2.20000-134.jar:2.8.0.7.3.2.20000-134]
> at org.apache.ranger.authorization.hive.authorizer.RangerHiveAuthorizer.grantRole(RangerHiveAuthorizer.java:582) ~[ranger-hive-plugin-2.8.0.7.3.2.20000-134.jar:2.8.0.7.3.2.20000-134]
> ... 26 more
> ERROR : FAILED: Execution Error, return code 40000 from org.apache.hadoop.hive.ql.ddl.DDLTask. java.lang.Exception: HTTP 400 Error: User doesn't have permissions to grant role role_100
> INFO : Completed executing command(queryId=hive_20260716191903_17958d74-c978-47b5-bbf4-f5cee5cc16e2); Time taken: 0.028 seconds
> INFO : OK
> Error: Error while compiling statement: FAILED: Execution Error, return code 40000 from org.apache.hadoop.hive.ql.ddl.DDLTask. java.lang.Exception: HTTP 400 Error: User doesn't have permissions to grant role role_100; Query ID: hive_20260716191903_17958d74-c978-47b5-bbf4-f5cee5cc16e2 (state=08S01,code=40000)
> {code}
--
This message was sent by Atlassian Jira
(v8.20.10#820010)