go auth_error ai_generated partial

rpc error: code = PermissionDenied desc = caller does not have permission to access resource

ID: go/grpc-permission-denied

Also available as: JSON · Markdown · 中文
80%Fix Rate
84%Confidence
0Evidence
2024-11-19First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
1.x active — — —

Root Cause

The authenticated caller passed authentication but failed authorization — the principal lacks the required role/scope for the method or resource. Often the token is valid but issued for a different audience or scope.

generic

中文

已认证的调用方通过了身份验证，但未通过授权——该主体缺少访问该方法或资源所需的角色/作用域。通常令牌有效，但签发给了不同的受众或作用域。

Workarounds

  1. 85% success 
    Log the principal and required scope to confirm the mismatch, and verify the token audience:

p, _ := peer.FromContext(ctx)
log.Printf("denied for peer=%v method=%s", p.Addr, method)
// decode JWT claims: check aud and scope
  2. 82% success 
    Request the correct OAuth scope when minting the token and propagate it through the interceptor:

// ensure scope includes the API's required scope, e.g. "orders.write"
ts := config.TokenSource(ctx, &oauth2.Token{AccessToken: tok})
ctx = metadata.AppendToOutgoingContext(ctx, "authorization", "Bearer "+tok)

Dead Ends

Common approaches that don't work:

  1. 85% fail

    Refreshing a valid token yields another valid token with the same scopes; authorization still fails.

  2. 95% fail

    Authorization decisions are deterministic per principal; retrying never grants a missing permission.