apache/cassandra · error · InvalidRequestException

Cannot DROP primary role for current login

Error message

Cannot DROP primary role for current login

What it means

Cassandra throws InvalidRequestException to prevent a user from dropping the role that backs their own current login. Dropping your primary role would strand the active session and is rejected unconditionally in validate(), regardless of superuser status.

Source

Thrown at src/java/org/apache/cassandra/cql3/statements/DropRoleStatement.java:71

        // We only check superuser status for existing roles to avoid
        // caching info about roles which don't exist (CASSANDRA-9189)
        if (DatabaseDescriptor.getRoleManager().isExistingRole(role)
            && Roles.hasSuperuserStatus(role)
            && !state.getUser().isSuper())
            throw new UnauthorizedException("Only superusers can drop a role with superuser status");
    }

    public void validate(ClientState state) throws RequestValidationException
    {
        // validate login here before authorize to avoid leaking user existence to anonymous users.
        state.ensureNotAnonymous();

        if (!ifExists && !DatabaseDescriptor.getRoleManager().isExistingRole(role))
            throw new InvalidRequestException(String.format("%s doesn't exist", role.getRoleName()));

        AuthenticatedUser user = state.getUser();
        if (user != null && user.getName().equals(role.getRoleName()))
            throw new InvalidRequestException("Cannot DROP primary role for current login");
    }

    public ResultMessage execute(ClientState state) throws RequestValidationException, RequestExecutionException
    {
        // not rejected in validate()
        if (ifExists && !DatabaseDescriptor.getRoleManager().isExistingRole(role))
            return null;

        // clean up grants and permissions of/on the dropped role.
        DatabaseDescriptor.getRoleManager().dropRole(state.getUser(), role);
        DatabaseDescriptor.getAuthorizer().revokeAllFrom(role);
        DatabaseDescriptor.getAuthorizer().revokeAllOn(role);
        DatabaseDescriptor.getNetworkAuthorizer().drop(role);
        DatabaseDescriptor.getCIDRAuthorizer().dropCidrPermissionsForRole(role);
        return null;
    }
    
    @Override

View on GitHub (pinned to 88fd0f6a0e)

Solutions

  1. Log in as a different role and drop the target role from that session
  2. Pick a different role to drop, or simply demote yourself instead of dropping
  3. In scripts, filter out the current authenticated role before issuing DROP ROLE

Example fix

// before
-- logged in as 'svc_admin'
DROP ROLE svc_admin; // InvalidRequestException
// after
-- login as 'bootstrap_super' first
DROP ROLE svc_admin;
Defensive patterns

Strategy: validation

Validate before calling

String current = authenticatedUserName; // from session
if (current.equals(roleToDrop)) throw new IllegalArgumentException("refusing to drop own login role");

Try / catch

try { session.execute("DROP ROLE " + name); } catch (InvalidRequestException e) { if (e.getMessage().contains("Cannot DROP primary role")) log.error("cannot drop the role you are logged in as"); else throw e; }

Prevention

When it happens

Trigger: An authenticated user executes DROP ROLE <their-own-username>, i.e. state.getUser().getName() equals role.getRoleName().

Common situations: Scripts iterating roles without excluding the executing identity; an admin accidentally targeting themselves while cleaning up accounts; copy-pasted statements that kept the admin's own role name.

Understand the failure class

Background: "Invalid state transition" errors: "status must be X, actually Y", "already rejected/charging/uninstalled", "cannot ... while running" — what they mean when a library rejects your call — this error's family across 31 libraries.

Related errors

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/e7c86276b5ece314. Report an issue: GitHub.