apache/cassandra · error · UnauthorizedException

Only superusers are allowed to alter access to datacenters.

Error message

Only superusers are allowed to alter access to datacenters.

What it means

AlterRoleStatement.authorize rejects changes to datacenter access (DC permissions) by non-superusers. Modifying which datacenters a role can access is a superuser-only operation, enforced after the superuser-option checks in authorize.

Solutions

  1. Execute the DC-permission ALTER as a superuser
  2. Have a superuser perform only the DC ACCESS portion while the non-super user makes other option changes
  3. Grant superuser to the operating role if policy permits

Example fix

// before (non-super user)
ALTER ROLE app_role WITH SET ACCESS TO ALL DATACENTERS;
// after: run as superuser, or remove the DC clause
ALTER ROLE app_role WITH LOGIN = true;
Defensive patterns

Strategy: validation

Validate before calling

// pre-check caller is superuser before DC permission changes
if (dcPermissionsClause != null && !currentUser.isSuper())
    throw new IllegalStateException("DC permission changes require a superuser account");

Try / catch

try { session.execute(alterRoleCql); } catch (UnauthorizedException e) { if (e.getMessage().contains("alter access to datacenters")) { /* rerun with superuser credentials */ } else throw e; }

Prevention

When it happens

Trigger: ALTER ROLE x WITH ... DC-permission clause (e.g. SET ACCESS TO DATACENTERS) executed when dcPermissions != null and user.isSuper() is false.

Common situations: Non-super admins provisioning multi-DC access for app roles; scripts migrated from environments where lesser admins could manage DC grants; mistaken assumption that ALTER permission on a role includes DC permission changes.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/8fd6f52afbce2892. Report an issue: GitHub.

Appendix: source

Thrown at src/java/org/apache/cassandra/cql3/statements/AlterRoleStatement.java:110

        {
            checkTrue(ifExists, "Role %s doesn't exist", role.getRoleName());
        }
    }

    public void authorize(ClientState state) throws UnauthorizedException
    {
        AuthenticatedUser user = state.getUser();
        boolean isSuper = user.isSuper();

        if (opts.getSuperuser().isPresent() && user.getRoles().contains(role))
            throw new UnauthorizedException("You aren't allowed to alter your own superuser " +
                                            "status or that of a role granted to you");

        if (opts.getSuperuser().isPresent() && !isSuper)
            throw new UnauthorizedException("Only superusers are allowed to alter superuser status");

        if (dcPermissions != null && !isSuper)
            throw new UnauthorizedException("Only superusers are allowed to alter access to datacenters.");

        if (cidrPermissions != null && !isSuper)
            throw new UnauthorizedException("Only superusers are allowed to alter access from CIDR groups.");

        // superusers can do whatever else they like
        if (isSuper)
            return;

        // a role may only modify the subset of its own attributes as determined by IRoleManager#alterableOptions
        if (user.getName().equals(role.getRoleName()))
        {
            for (Option option : opts.getOptions().keySet())
            {
                if (!DatabaseDescriptor.getRoleManager().alterableOptions().contains(option))
                    throw new UnauthorizedException(String.format("You aren't allowed to alter %s", option));
            }
        }
        else

View on GitHub (pinned to 88fd0f6a0e)