[
https://issues.apache.org/jira/browse/RANGER-5726?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Fang-Yu Rao updated RANGER-5726:
--------------------------------
Description:
We found the Ranger server would return an incorrect error message when an
admin tries to grant a non-existing role to a user. In what follows I provide
the steps to reproduce the issue in a beeline instance connected to a version
of Hive Server2.
{code}
# This verifies the requesting user is allowed to create a role 'role_100'.
0: jdbc:hive2://ccycloud-1.cdpd102205p01d06.r> create role role_100;
INFO : Compiling
command(queryId=hive_20260716191507_8f9415f3-5035-4d50-8029-ae5f8dee3ecb):
create role role_100
INFO : Semantic Analysis Completed (retrial = false)
INFO : Created Hive schema: Schema(fieldSchemas:null, properties:null)
INFO : Completed compiling
command(queryId=hive_20260716191507_8f9415f3-5035-4d50-8029-ae5f8dee3ecb); Time
taken: 0.03 seconds
INFO : Executing
command(queryId=hive_20260716191507_8f9415f3-5035-4d50-8029-ae5f8dee3ecb):
create role role_100
INFO : Starting task [Stage-0:DDL] in serial mode
INFO : Completed executing
command(queryId=hive_20260716191507_8f9415f3-5035-4d50-8029-ae5f8dee3ecb); Time
taken: 0.037 seconds
INFO : OK
No rows affected (0.083 seconds)
# # This verifies the role 'role_100' is dropped.
0: jdbc:hive2://ccycloud-1.cdpd102205p01d06.r> drop role role_100;
INFO : Compiling
command(queryId=hive_20260716191832_75c3783e-3e19-476d-a293-fd513629ddea): drop
role role_100
INFO : Semantic Analysis Completed (retrial = false)
INFO : Created Hive schema: Schema(fieldSchemas:null, properties:null)
INFO : Completed compiling
command(queryId=hive_20260716191832_75c3783e-3e19-476d-a293-fd513629ddea); Time
taken: 0.003 seconds
INFO : Executing
command(queryId=hive_20260716191832_75c3783e-3e19-476d-a293-fd513629ddea): drop
role role_100
INFO : Starting task [Stage-0:DDL] in serial mode
INFO : Completed executing
command(queryId=hive_20260716191832_75c3783e-3e19-476d-a293-fd513629ddea); Time
taken: 0.043 seconds
INFO : OK
No rows affected (0.061 seconds)
# # This reproduces the issue.
0: jdbc:hive2://ccycloud-1.cdpd102205p01d06.r> grant role role_100 to user
hdfs;
INFO : Compiling
command(queryId=hive_20260716191903_17958d74-c978-47b5-bbf4-f5cee5cc16e2):
grant role role_100 to user hdfs
INFO : Semantic Analysis Completed (retrial = false)
INFO : Created Hive schema: Schema(fieldSchemas:null, properties:null)
INFO : Completed compiling
command(queryId=hive_20260716191903_17958d74-c978-47b5-bbf4-f5cee5cc16e2); Time
taken: 0.003 seconds
INFO : Executing
command(queryId=hive_20260716191903_17958d74-c978-47b5-bbf4-f5cee5cc16e2):
grant role role_100 to user hdfs
INFO : Starting task [Stage-0:DDL] in serial mode
ERROR : Failed
org.apache.hadoop.hive.ql.security.authorization.plugin.HiveAccessControlException:
java.lang.Exception: HTTP 400 Error: User doesn't have permissions to grant
role role_100
at
org.apache.ranger.authorization.hive.authorizer.RangerHiveAuthorizer.grantRole(RangerHiveAuthorizer.java:585)
~[ranger-hive-plugin-2.8.0.7.3.2.20000-
134.jar:2.8.0.7.3.2.20000-134]
at
org.apache.hadoop.hive.ql.ddl.privilege.role.grant.GrantRoleOperation.execute(GrantRoleOperation.java:53)
~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.
1.3000.7.3.2.20000-134]
at org.apache.hadoop.hive.ql.ddl.DDLTask.execute(DDLTask.java:84)
~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
at org.apache.hadoop.hive.ql.exec.Task.executeTask(Task.java:213)
~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
at
org.apache.hadoop.hive.ql.exec.TaskRunner.runSequential(TaskRunner.java:105)
~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
at org.apache.hadoop.hive.ql.Executor.launchTask(Executor.java:354)
~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
at org.apache.hadoop.hive.ql.Executor.launchTasks(Executor.java:327)
~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
at org.apache.hadoop.hive.ql.Executor.runTasks(Executor.java:244)
~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
at org.apache.hadoop.hive.ql.Executor.execute(Executor.java:105)
~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
at org.apache.hadoop.hive.ql.Driver.execute(Driver.java:843)
~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
at org.apache.hadoop.hive.ql.Driver.runInternal(Driver.java:695)
~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
at org.apache.hadoop.hive.ql.Driver.run(Driver.java:536)
~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
at org.apache.hadoop.hive.ql.Driver.run(Driver.java:530)
~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
at
org.apache.hadoop.hive.ql.reexec.ReExecDriver.run(ReExecDriver.java:190)
~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
at
org.apache.hive.service.cli.operation.SQLOperation.runQuery(SQLOperation.java:232)
~[hive-service-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-1
34]
at
org.apache.hive.service.cli.operation.SQLOperation$BackgroundWork$1.run(SQLOperation.java:336)
~[hive-service-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7
.3.2.20000-134]
at
java.security.AccessController.doPrivileged(AccessController.java:712) ~[?:?]
at javax.security.auth.Subject.doAs(Subject.java:439) ~[?:?]
at
org.apache.hadoop.security.UserGroupInformation.doAs(UserGroupInformation.java:1964)
~[hadoop-common-3.4.2.7.3.2.20000-134.jar:?]
at
org.apache.hive.service.cli.operation.SQLOperation$BackgroundWork.run(SQLOperation.java:356)
~[hive-service-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3
.2.20000-134]
at
java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:539) ~[?:?]
at java.util.concurrent.FutureTask.run(FutureTask.java:264) ~[?:?]
at
java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:539) ~[?:?]
at java.util.concurrent.FutureTask.run(FutureTask.java:264) ~[?:?]
at
java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136)
~[?:?]
at
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)
~[?:?]
at java.lang.Thread.run(Thread.java:840) ~[?:?]
Caused by: java.lang.Exception: HTTP 400 Error: User doesn't have permissions
to grant role role_100
at
org.apache.ranger.admin.client.RangerAdminRESTClient.grantRole(RangerAdminRESTClient.java:571)
~[ranger-plugins-common-2.8.0.7.3.2.20000-134.jar:2.8.
0.7.3.2.20000-134]
... 26 more
ERROR : DDLTask failed, DDL Operation: class
org.apache.hadoop.hive.ql.ddl.privilege.role.grant.GrantRoleOperation
org.apache.hadoop.hive.ql.security.authorization.plugin.HiveAccessControlException:
java.lang.Exception: HTTP 400 Error: User doesn't have permissions to grant
role role_100
at
org.apache.ranger.authorization.hive.authorizer.RangerHiveAuthorizer.grantRole(RangerHiveAuthorizer.java:585)
~[ranger-hive-plugin-2.8.0.7.3.2.20000-134.jar:2.8.0.7.3.2.20000-134]
at
org.apache.hadoop.hive.ql.ddl.privilege.role.grant.GrantRoleOperation.execute(GrantRoleOperation.java:53)
~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
at org.apache.hadoop.hive.ql.ddl.DDLTask.execute(DDLTask.java:84)
~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
at org.apache.hadoop.hive.ql.exec.Task.executeTask(Task.java:213)
~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
at
org.apache.hadoop.hive.ql.exec.TaskRunner.runSequential(TaskRunner.java:105)
~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
at org.apache.hadoop.hive.ql.Executor.launchTask(Executor.java:354)
~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
at org.apache.hadoop.hive.ql.Executor.launchTasks(Executor.java:327)
~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
at org.apache.hadoop.hive.ql.Executor.runTasks(Executor.java:244)
~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
at org.apache.hadoop.hive.ql.Executor.execute(Executor.java:105)
~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
at org.apache.hadoop.hive.ql.Driver.execute(Driver.java:843)
~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
at org.apache.hadoop.hive.ql.Driver.runInternal(Driver.java:695)
~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
at org.apache.hadoop.hive.ql.Driver.run(Driver.java:536)
~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
at org.apache.hadoop.hive.ql.Driver.run(Driver.java:530)
~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
at
org.apache.hadoop.hive.ql.reexec.ReExecDriver.run(ReExecDriver.java:190)
~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
at
org.apache.hive.service.cli.operation.SQLOperation.runQuery(SQLOperation.java:232)
~[hive-service-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
at
org.apache.hive.service.cli.operation.SQLOperation$BackgroundWork$1.run(SQLOperation.java:336)
~[hive-service-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
at
java.security.AccessController.doPrivileged(AccessController.java:712) ~[?:?]
at javax.security.auth.Subject.doAs(Subject.java:439) ~[?:?]
at
org.apache.hadoop.security.UserGroupInformation.doAs(UserGroupInformation.java:1964)
~[hadoop-common-3.4.2.7.3.2.20000-134.jar:?]
at
org.apache.hive.service.cli.operation.SQLOperation$BackgroundWork.run(SQLOperation.java:356)
~[hive-service-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
at
java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:539) ~[?:?]
at java.util.concurrent.FutureTask.run(FutureTask.java:264) ~[?:?]
at
java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:539) ~[?:?]
at java.util.concurrent.FutureTask.run(FutureTask.java:264) ~[?:?]
at
java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136)
~[?:?]
at
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)
~[?:?]
at java.lang.Thread.run(Thread.java:840) ~[?:?]
Caused by: java.lang.Exception: HTTP 400 Error: User doesn't have permissions
to grant role role_100
at
org.apache.ranger.admin.client.RangerAdminRESTClient.grantRole(RangerAdminRESTClient.java:571)
~[ranger-plugins-common-2.8.0.7.3.2.20000-134.jar:2.8.0.7.3.2.20000-134]
at
org.apache.ranger.plugin.service.RangerBasePlugin.grantRole(RangerBasePlugin.java:1061)
~[ranger-plugins-common-2.8.0.7.3.2.20000-134.jar:2.8.0.7.3.2.20000-134]
at
org.apache.ranger.authorization.hive.authorizer.RangerHiveAuthorizer.grantRole(RangerHiveAuthorizer.java:582)
~[ranger-hive-plugin-2.8.0.7.3.2.20000-134.jar:2.8.0.7.3.2.20000-134]
... 26 more
ERROR : FAILED: Execution Error, return code 40000 from
org.apache.hadoop.hive.ql.ddl.DDLTask. java.lang.Exception: HTTP 400 Error:
User doesn't have permissions to grant role role_100
INFO : Completed executing
command(queryId=hive_20260716191903_17958d74-c978-47b5-bbf4-f5cee5cc16e2); Time
taken: 0.028 seconds
INFO : OK
Error: Error while compiling statement: FAILED: Execution Error, return code
40000 from org.apache.hadoop.hive.ql.ddl.DDLTask. java.lang.Exception: HTTP 400
Error: User doesn't have permissions to grant role role_100; Query ID:
hive_20260716191903_17958d74-c978-47b5-bbf4-f5cee5cc16e2
(state=08S01,code=40000)
{code}
was:
We found the Ranger server would return an incorrect error message when an
admin tries to grant a non-existing role to a user. In what follows I provide
the steps to reproduce the issue in a beeline instance connected to a version
of Hive Server2.
{code}
# This verifies the requesting user is allowed to create a role 'role_100'.
0: jdbc:hive2://ccycloud-1.cdpd102205p01d06.r> create role role_100;
INFO : Compiling
command(queryId=hive_20260716191507_8f9415f3-5035-4d50-8029-ae5f8dee3ecb):
create role role_100
INFO : Semantic Analysis Completed (retrial = false)
INFO : Created Hive schema: Schema(fieldSchemas:null, properties:null)
INFO : Completed compiling
command(queryId=hive_20260716191507_8f9415f3-5035-4d50-8029-ae5f8dee3ecb); Time
taken: 0.03 seconds
INFO : Executing
command(queryId=hive_20260716191507_8f9415f3-5035-4d50-8029-ae5f8dee3ecb):
create role role_100
INFO : Starting task [Stage-0:DDL] in serial mode
INFO : Completed executing
command(queryId=hive_20260716191507_8f9415f3-5035-4d50-8029-ae5f8dee3ecb); Time
taken: 0.037 seconds
INFO : OK
No rows affected (0.083 seconds)
# This verifies the role 'role_100' is dropped.
0: jdbc:hive2://ccycloud-1.cdpd102205p01d06.r> drop role role_100;
INFO : Compiling
command(queryId=hive_20260716191832_75c3783e-3e19-476d-a293-fd513629ddea): drop
role role_100
INFO : Semantic Analysis Completed (retrial = false)
INFO : Created Hive schema: Schema(fieldSchemas:null, properties:null)
INFO : Completed compiling
command(queryId=hive_20260716191832_75c3783e-3e19-476d-a293-fd513629ddea); Time
taken: 0.003 seconds
INFO : Executing
command(queryId=hive_20260716191832_75c3783e-3e19-476d-a293-fd513629ddea): drop
role role_100
INFO : Starting task [Stage-0:DDL] in serial mode
INFO : Completed executing
command(queryId=hive_20260716191832_75c3783e-3e19-476d-a293-fd513629ddea); Time
taken: 0.043 seconds
INFO : OK
No rows affected (0.061 seconds)
# This reproduces the issue.
0: jdbc:hive2://ccycloud-1.cdpd102205p01d06.r> grant role role_100 to user
hdfs;
INFO : Compiling
command(queryId=hive_20260716191903_17958d74-c978-47b5-bbf4-f5cee5cc16e2):
grant role role_100 to user hdfs
INFO : Semantic Analysis Completed (retrial = false)
INFO : Created Hive schema: Schema(fieldSchemas:null, properties:null)
INFO : Completed compiling
command(queryId=hive_20260716191903_17958d74-c978-47b5-bbf4-f5cee5cc16e2); Time
taken: 0.003 seconds
INFO : Executing
command(queryId=hive_20260716191903_17958d74-c978-47b5-bbf4-f5cee5cc16e2):
grant role role_100 to user hdfs
INFO : Starting task [Stage-0:DDL] in serial mode
ERROR : Failed
org.apache.hadoop.hive.ql.security.authorization.plugin.HiveAccessControlException:
java.lang.Exception: HTTP 400 Error: User doesn't have permissions to grant
role role_100
at
org.apache.ranger.authorization.hive.authorizer.RangerHiveAuthorizer.grantRole(RangerHiveAuthorizer.java:585)
~[ranger-hive-plugin-2.8.0.7.3.2.20000-
134.jar:2.8.0.7.3.2.20000-134]
at
org.apache.hadoop.hive.ql.ddl.privilege.role.grant.GrantRoleOperation.execute(GrantRoleOperation.java:53)
~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.
1.3000.7.3.2.20000-134]
at org.apache.hadoop.hive.ql.ddl.DDLTask.execute(DDLTask.java:84)
~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
at org.apache.hadoop.hive.ql.exec.Task.executeTask(Task.java:213)
~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
at
org.apache.hadoop.hive.ql.exec.TaskRunner.runSequential(TaskRunner.java:105)
~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
at org.apache.hadoop.hive.ql.Executor.launchTask(Executor.java:354)
~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
at org.apache.hadoop.hive.ql.Executor.launchTasks(Executor.java:327)
~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
at org.apache.hadoop.hive.ql.Executor.runTasks(Executor.java:244)
~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
at org.apache.hadoop.hive.ql.Executor.execute(Executor.java:105)
~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
at org.apache.hadoop.hive.ql.Driver.execute(Driver.java:843)
~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
at org.apache.hadoop.hive.ql.Driver.runInternal(Driver.java:695)
~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
at org.apache.hadoop.hive.ql.Driver.run(Driver.java:536)
~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
at org.apache.hadoop.hive.ql.Driver.run(Driver.java:530)
~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
at
org.apache.hadoop.hive.ql.reexec.ReExecDriver.run(ReExecDriver.java:190)
~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
at
org.apache.hive.service.cli.operation.SQLOperation.runQuery(SQLOperation.java:232)
~[hive-service-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-1
34]
at
org.apache.hive.service.cli.operation.SQLOperation$BackgroundWork$1.run(SQLOperation.java:336)
~[hive-service-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7
.3.2.20000-134]
at
java.security.AccessController.doPrivileged(AccessController.java:712) ~[?:?]
at javax.security.auth.Subject.doAs(Subject.java:439) ~[?:?]
at
org.apache.hadoop.security.UserGroupInformation.doAs(UserGroupInformation.java:1964)
~[hadoop-common-3.4.2.7.3.2.20000-134.jar:?]
at
org.apache.hive.service.cli.operation.SQLOperation$BackgroundWork.run(SQLOperation.java:356)
~[hive-service-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3
.2.20000-134]
at
java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:539) ~[?:?]
at java.util.concurrent.FutureTask.run(FutureTask.java:264) ~[?:?]
at
java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:539) ~[?:?]
at java.util.concurrent.FutureTask.run(FutureTask.java:264) ~[?:?]
at
java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136)
~[?:?]
at
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)
~[?:?]
at java.lang.Thread.run(Thread.java:840) ~[?:?]
Caused by: java.lang.Exception: HTTP 400 Error: User doesn't have permissions
to grant role role_100
at
org.apache.ranger.admin.client.RangerAdminRESTClient.grantRole(RangerAdminRESTClient.java:571)
~[ranger-plugins-common-2.8.0.7.3.2.20000-134.jar:2.8.
0.7.3.2.20000-134]
... 26 more
ERROR : DDLTask failed, DDL Operation: class
org.apache.hadoop.hive.ql.ddl.privilege.role.grant.GrantRoleOperation
org.apache.hadoop.hive.ql.security.authorization.plugin.HiveAccessControlException:
java.lang.Exception: HTTP 400 Error: User doesn't have permissions to grant
role role_100
at
org.apache.ranger.authorization.hive.authorizer.RangerHiveAuthorizer.grantRole(RangerHiveAuthorizer.java:585)
~[ranger-hive-plugin-2.8.0.7.3.2.20000-134.jar:2.8.0.7.3.2.20000-134]
at
org.apache.hadoop.hive.ql.ddl.privilege.role.grant.GrantRoleOperation.execute(GrantRoleOperation.java:53)
~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
at org.apache.hadoop.hive.ql.ddl.DDLTask.execute(DDLTask.java:84)
~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
at org.apache.hadoop.hive.ql.exec.Task.executeTask(Task.java:213)
~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
at
org.apache.hadoop.hive.ql.exec.TaskRunner.runSequential(TaskRunner.java:105)
~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
at org.apache.hadoop.hive.ql.Executor.launchTask(Executor.java:354)
~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
at org.apache.hadoop.hive.ql.Executor.launchTasks(Executor.java:327)
~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
at org.apache.hadoop.hive.ql.Executor.runTasks(Executor.java:244)
~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
at org.apache.hadoop.hive.ql.Executor.execute(Executor.java:105)
~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
at org.apache.hadoop.hive.ql.Driver.execute(Driver.java:843)
~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
at org.apache.hadoop.hive.ql.Driver.runInternal(Driver.java:695)
~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
at org.apache.hadoop.hive.ql.Driver.run(Driver.java:536)
~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
at org.apache.hadoop.hive.ql.Driver.run(Driver.java:530)
~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
at
org.apache.hadoop.hive.ql.reexec.ReExecDriver.run(ReExecDriver.java:190)
~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
at
org.apache.hive.service.cli.operation.SQLOperation.runQuery(SQLOperation.java:232)
~[hive-service-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
at
org.apache.hive.service.cli.operation.SQLOperation$BackgroundWork$1.run(SQLOperation.java:336)
~[hive-service-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
at
java.security.AccessController.doPrivileged(AccessController.java:712) ~[?:?]
at javax.security.auth.Subject.doAs(Subject.java:439) ~[?:?]
at
org.apache.hadoop.security.UserGroupInformation.doAs(UserGroupInformation.java:1964)
~[hadoop-common-3.4.2.7.3.2.20000-134.jar:?]
at
org.apache.hive.service.cli.operation.SQLOperation$BackgroundWork.run(SQLOperation.java:356)
~[hive-service-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
at
java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:539) ~[?:?]
at java.util.concurrent.FutureTask.run(FutureTask.java:264) ~[?:?]
at
java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:539) ~[?:?]
at java.util.concurrent.FutureTask.run(FutureTask.java:264) ~[?:?]
at
java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136)
~[?:?]
at
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)
~[?:?]
at java.lang.Thread.run(Thread.java:840) ~[?:?]
Caused by: java.lang.Exception: HTTP 400 Error: User doesn't have permissions
to grant role role_100
at
org.apache.ranger.admin.client.RangerAdminRESTClient.grantRole(RangerAdminRESTClient.java:571)
~[ranger-plugins-common-2.8.0.7.3.2.20000-134.jar:2.8.0.7.3.2.20000-134]
at
org.apache.ranger.plugin.service.RangerBasePlugin.grantRole(RangerBasePlugin.java:1061)
~[ranger-plugins-common-2.8.0.7.3.2.20000-134.jar:2.8.0.7.3.2.20000-134]
at
org.apache.ranger.authorization.hive.authorizer.RangerHiveAuthorizer.grantRole(RangerHiveAuthorizer.java:582)
~[ranger-hive-plugin-2.8.0.7.3.2.20000-134.jar:2.8.0.7.3.2.20000-134]
... 26 more
ERROR : FAILED: Execution Error, return code 40000 from
org.apache.hadoop.hive.ql.ddl.DDLTask. java.lang.Exception: HTTP 400 Error:
User doesn't have permissions to grant role role_100
INFO : Completed executing
command(queryId=hive_20260716191903_17958d74-c978-47b5-bbf4-f5cee5cc16e2); Time
taken: 0.028 seconds
INFO : OK
Error: Error while compiling statement: FAILED: Execution Error, return code
40000 from org.apache.hadoop.hive.ql.ddl.DDLTask. java.lang.Exception: HTTP 400
Error: User doesn't have permissions to grant role role_100; Query ID:
hive_20260716191903_17958d74-c978-47b5-bbf4-f5cee5cc16e2
(state=08S01,code=40000)
{code}
> Ranger server returns an incorrect error message when an admin tries to
> revoke a non-existing role from a user
> --------------------------------------------------------------------------------------------------------------
>
> Key: RANGER-5726
> URL: https://issues.apache.org/jira/browse/RANGER-5726
> Project: Ranger
> Issue Type: Bug
> Components: Ranger
> Reporter: Fang-Yu Rao
> Priority: Major
>
> We found the Ranger server would return an incorrect error message when an
> admin tries to grant a non-existing role to a user. In what follows I provide
> the steps to reproduce the issue in a beeline instance connected to a version
> of Hive Server2.
> {code}
> # This verifies the requesting user is allowed to create a role 'role_100'.
> 0: jdbc:hive2://ccycloud-1.cdpd102205p01d06.r> create role role_100;
> INFO : Compiling
> command(queryId=hive_20260716191507_8f9415f3-5035-4d50-8029-ae5f8dee3ecb):
> create role role_100
> INFO : Semantic Analysis Completed (retrial = false)
> INFO : Created Hive schema: Schema(fieldSchemas:null, properties:null)
> INFO : Completed compiling
> command(queryId=hive_20260716191507_8f9415f3-5035-4d50-8029-ae5f8dee3ecb);
> Time taken: 0.03 seconds
> INFO : Executing
> command(queryId=hive_20260716191507_8f9415f3-5035-4d50-8029-ae5f8dee3ecb):
> create role role_100
> INFO : Starting task [Stage-0:DDL] in serial mode
> INFO : Completed executing
> command(queryId=hive_20260716191507_8f9415f3-5035-4d50-8029-ae5f8dee3ecb);
> Time taken: 0.037 seconds
> INFO : OK
> No rows affected (0.083 seconds)
> # # This verifies the role 'role_100' is dropped.
> 0: jdbc:hive2://ccycloud-1.cdpd102205p01d06.r> drop role role_100;
> INFO : Compiling
> command(queryId=hive_20260716191832_75c3783e-3e19-476d-a293-fd513629ddea):
> drop role role_100
> INFO : Semantic Analysis Completed (retrial = false)
> INFO : Created Hive schema: Schema(fieldSchemas:null, properties:null)
> INFO : Completed compiling
> command(queryId=hive_20260716191832_75c3783e-3e19-476d-a293-fd513629ddea);
> Time taken: 0.003 seconds
> INFO : Executing
> command(queryId=hive_20260716191832_75c3783e-3e19-476d-a293-fd513629ddea):
> drop role role_100
> INFO : Starting task [Stage-0:DDL] in serial mode
> INFO : Completed executing
> command(queryId=hive_20260716191832_75c3783e-3e19-476d-a293-fd513629ddea);
> Time taken: 0.043 seconds
> INFO : OK
> No rows affected (0.061 seconds)
> # # This reproduces the issue.
> 0: jdbc:hive2://ccycloud-1.cdpd102205p01d06.r> grant role role_100 to user
> hdfs;
>
> INFO : Compiling
> command(queryId=hive_20260716191903_17958d74-c978-47b5-bbf4-f5cee5cc16e2):
> grant role role_100 to user hdfs
> INFO : Semantic Analysis Completed (retrial = false)
>
>
> INFO : Created Hive schema: Schema(fieldSchemas:null, properties:null)
>
>
> INFO : Completed compiling
> command(queryId=hive_20260716191903_17958d74-c978-47b5-bbf4-f5cee5cc16e2);
> Time taken: 0.003 seconds
> INFO : Executing
> command(queryId=hive_20260716191903_17958d74-c978-47b5-bbf4-f5cee5cc16e2):
> grant role role_100 to user hdfs
> INFO : Starting task [Stage-0:DDL] in serial mode
>
>
> ERROR : Failed
>
>
> org.apache.hadoop.hive.ql.security.authorization.plugin.HiveAccessControlException:
> java.lang.Exception: HTTP 400 Error: User doesn't have permissions to grant
> role role_100
>
>
> at
> org.apache.ranger.authorization.hive.authorizer.RangerHiveAuthorizer.grantRole(RangerHiveAuthorizer.java:585)
> ~[ranger-hive-plugin-2.8.0.7.3.2.20000-
> 134.jar:2.8.0.7.3.2.20000-134]
>
>
> at
> org.apache.hadoop.hive.ql.ddl.privilege.role.grant.GrantRoleOperation.execute(GrantRoleOperation.java:53)
> ~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.
> 1.3000.7.3.2.20000-134]
>
>
> at org.apache.hadoop.hive.ql.ddl.DDLTask.execute(DDLTask.java:84)
> ~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
>
> at org.apache.hadoop.hive.ql.exec.Task.executeTask(Task.java:213)
> ~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
>
> at
> org.apache.hadoop.hive.ql.exec.TaskRunner.runSequential(TaskRunner.java:105)
> ~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
> at org.apache.hadoop.hive.ql.Executor.launchTask(Executor.java:354)
> ~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
>
> at org.apache.hadoop.hive.ql.Executor.launchTasks(Executor.java:327)
> ~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
>
> at org.apache.hadoop.hive.ql.Executor.runTasks(Executor.java:244)
> ~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
>
> at org.apache.hadoop.hive.ql.Executor.execute(Executor.java:105)
> ~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
>
> at org.apache.hadoop.hive.ql.Driver.execute(Driver.java:843)
> ~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
>
> at org.apache.hadoop.hive.ql.Driver.runInternal(Driver.java:695)
> ~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
>
> at org.apache.hadoop.hive.ql.Driver.run(Driver.java:536)
> ~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
>
> at org.apache.hadoop.hive.ql.Driver.run(Driver.java:530)
> ~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
>
> at
> org.apache.hadoop.hive.ql.reexec.ReExecDriver.run(ReExecDriver.java:190)
> ~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
> at
> org.apache.hive.service.cli.operation.SQLOperation.runQuery(SQLOperation.java:232)
> ~[hive-service-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-1
> 34]
>
>
> at
> org.apache.hive.service.cli.operation.SQLOperation$BackgroundWork$1.run(SQLOperation.java:336)
> ~[hive-service-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7
> .3.2.20000-134]
>
>
> at
> java.security.AccessController.doPrivileged(AccessController.java:712) ~[?:?]
>
> at javax.security.auth.Subject.doAs(Subject.java:439) ~[?:?]
>
>
> at
> org.apache.hadoop.security.UserGroupInformation.doAs(UserGroupInformation.java:1964)
> ~[hadoop-common-3.4.2.7.3.2.20000-134.jar:?]
> at
> org.apache.hive.service.cli.operation.SQLOperation$BackgroundWork.run(SQLOperation.java:356)
> ~[hive-service-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3
> .2.20000-134]
>
>
> at
> java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:539)
> ~[?:?]
> at java.util.concurrent.FutureTask.run(FutureTask.java:264) ~[?:?]
>
>
> at
> java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:539)
> ~[?:?]
> at java.util.concurrent.FutureTask.run(FutureTask.java:264) ~[?:?]
>
>
> at
> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136)
> ~[?:?]
> at
> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)
> ~[?:?]
> at java.lang.Thread.run(Thread.java:840) ~[?:?]
>
>
> Caused by: java.lang.Exception: HTTP 400 Error: User doesn't have permissions
> to grant role role_100
> at
> org.apache.ranger.admin.client.RangerAdminRESTClient.grantRole(RangerAdminRESTClient.java:571)
> ~[ranger-plugins-common-2.8.0.7.3.2.20000-134.jar:2.8.
> 0.7.3.2.20000-134]
> ... 26 more
> ERROR : DDLTask failed, DDL Operation: class
> org.apache.hadoop.hive.ql.ddl.privilege.role.grant.GrantRoleOperation
> org.apache.hadoop.hive.ql.security.authorization.plugin.HiveAccessControlException:
> java.lang.Exception: HTTP 400 Error: User doesn't have permissions to grant
> role role_100
> at
> org.apache.ranger.authorization.hive.authorizer.RangerHiveAuthorizer.grantRole(RangerHiveAuthorizer.java:585)
> ~[ranger-hive-plugin-2.8.0.7.3.2.20000-134.jar:2.8.0.7.3.2.20000-134]
> at
> org.apache.hadoop.hive.ql.ddl.privilege.role.grant.GrantRoleOperation.execute(GrantRoleOperation.java:53)
> ~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
> at org.apache.hadoop.hive.ql.ddl.DDLTask.execute(DDLTask.java:84)
> ~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
> at org.apache.hadoop.hive.ql.exec.Task.executeTask(Task.java:213)
> ~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
> at
> org.apache.hadoop.hive.ql.exec.TaskRunner.runSequential(TaskRunner.java:105)
> ~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
> at org.apache.hadoop.hive.ql.Executor.launchTask(Executor.java:354)
> ~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
> at org.apache.hadoop.hive.ql.Executor.launchTasks(Executor.java:327)
> ~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
> at org.apache.hadoop.hive.ql.Executor.runTasks(Executor.java:244)
> ~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
> at org.apache.hadoop.hive.ql.Executor.execute(Executor.java:105)
> ~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
> at org.apache.hadoop.hive.ql.Driver.execute(Driver.java:843)
> ~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
> at org.apache.hadoop.hive.ql.Driver.runInternal(Driver.java:695)
> ~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
> at org.apache.hadoop.hive.ql.Driver.run(Driver.java:536)
> ~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
> at org.apache.hadoop.hive.ql.Driver.run(Driver.java:530)
> ~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
> at
> org.apache.hadoop.hive.ql.reexec.ReExecDriver.run(ReExecDriver.java:190)
> ~[hive-exec-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
> at
> org.apache.hive.service.cli.operation.SQLOperation.runQuery(SQLOperation.java:232)
> ~[hive-service-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
> at
> org.apache.hive.service.cli.operation.SQLOperation$BackgroundWork$1.run(SQLOperation.java:336)
> ~[hive-service-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
> at
> java.security.AccessController.doPrivileged(AccessController.java:712) ~[?:?]
> at javax.security.auth.Subject.doAs(Subject.java:439) ~[?:?]
> at
> org.apache.hadoop.security.UserGroupInformation.doAs(UserGroupInformation.java:1964)
> ~[hadoop-common-3.4.2.7.3.2.20000-134.jar:?]
> at
> org.apache.hive.service.cli.operation.SQLOperation$BackgroundWork.run(SQLOperation.java:356)
> ~[hive-service-3.1.3000.7.3.2.20000-134.jar:3.1.3000.7.3.2.20000-134]
> at
> java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:539) ~[?:?]
> at java.util.concurrent.FutureTask.run(FutureTask.java:264) ~[?:?]
> at
> java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:539) ~[?:?]
> at java.util.concurrent.FutureTask.run(FutureTask.java:264) ~[?:?]
> at
> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136)
> ~[?:?]
> at
> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)
> ~[?:?]
> at java.lang.Thread.run(Thread.java:840) ~[?:?]
> Caused by: java.lang.Exception: HTTP 400 Error: User doesn't have permissions
> to grant role role_100
> at
> org.apache.ranger.admin.client.RangerAdminRESTClient.grantRole(RangerAdminRESTClient.java:571)
> ~[ranger-plugins-common-2.8.0.7.3.2.20000-134.jar:2.8.0.7.3.2.20000-134]
> at
> org.apache.ranger.plugin.service.RangerBasePlugin.grantRole(RangerBasePlugin.java:1061)
> ~[ranger-plugins-common-2.8.0.7.3.2.20000-134.jar:2.8.0.7.3.2.20000-134]
> at
> org.apache.ranger.authorization.hive.authorizer.RangerHiveAuthorizer.grantRole(RangerHiveAuthorizer.java:582)
> ~[ranger-hive-plugin-2.8.0.7.3.2.20000-134.jar:2.8.0.7.3.2.20000-134]
> ... 26 more
> ERROR : FAILED: Execution Error, return code 40000 from
> org.apache.hadoop.hive.ql.ddl.DDLTask. java.lang.Exception: HTTP 400 Error:
> User doesn't have permissions to grant role role_100
> INFO : Completed executing
> command(queryId=hive_20260716191903_17958d74-c978-47b5-bbf4-f5cee5cc16e2);
> Time taken: 0.028 seconds
> INFO : OK
> Error: Error while compiling statement: FAILED: Execution Error, return code
> 40000 from org.apache.hadoop.hive.ql.ddl.DDLTask. java.lang.Exception: HTTP
> 400 Error: User doesn't have permissions to grant role role_100; Query ID:
> hive_20260716191903_17958d74-c978-47b5-bbf4-f5cee5cc16e2
> (state=08S01,code=40000)
> {code}
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
