apache/cassandra · error · InvalidRequestException

%s

Error message

%s

What it means

If the configured IAuthorizer does not support listing permissions, it signals this by throwing UnsupportedOperationException from its list() method; Cassandra converts it to an InvalidRequestException carrying the authorizer's message. This happens with authorizer implementations like AllowAllAuthorizer or custom ones lacking LIST support.

Source

Thrown at src/java/org/apache/cassandra/cql3/statements/ListPermissionsStatement.java:130

            throw new InvalidRequestException(String.format("%s doesn't exist", resource));

        if ((grantee != null) && !DatabaseDescriptor.getRoleManager().isExistingRole(grantee))
            throw new InvalidRequestException(String.format("%s doesn't exist", grantee));

        Collections.sort(details);
        return resultMessage(details);
    }

    private Set<PermissionDetails> list(ClientState state, IResource resource)
    throws RequestValidationException, RequestExecutionException
    {
        try
        {
            return DatabaseDescriptor.getAuthorizer().list(state.getUser(), permissions, resource, grantee);
        }
        catch (UnsupportedOperationException e)
        {
            throw new InvalidRequestException(e.getMessage());
        }
    }

    private ResultMessage resultMessage(List<PermissionDetails> details)
    {
        if (details.isEmpty())
            return new ResultMessage.Void();

        ResultSet.ResultMetadata resultMetadata = new ResultSet.ResultMetadata(metadata);
        ResultSet result = new ResultSet(resultMetadata);
        for (PermissionDetails pd : details)
        {
            result.addColumnValue(UTF8Type.instance.decompose(pd.grantee));
            result.addColumnValue(UTF8Type.instance.decompose(pd.grantee));
            result.addColumnValue(UTF8Type.instance.decompose(pd.resource.toString()));
            result.addColumnValue(UTF8Type.instance.decompose(pd.permission.toString()));
        }
        return new ResultMessage.Rows(result);

View on GitHub (pinned to 88fd0f6a0e)

Solutions

1. Configure a list-capable authorizer such as CassandraAuthorizer in cassandra.yaml and restart
2. Implement list() in your custom IAuthorizer instead of throwing UnsupportedOperationException
3. Check the authorizer's message in the exception for the exact unsupported capability

Example fix

// cassandra.yaml
// before
authorizer: AllowAllAuthorizer
// after
authorizer: CassandraAuthorizer

// only CassandraAuthorizer (or custom impls overriding list) supports LIST PERMISSIONS
if (!config.getAuthorizer().equals("CassandraAuthorizer")) throw new IllegalStateException("LIST PERMISSIONS requires a list-capable authorizer, got " + config.getAuthorizer());

try { session.execute("LIST ALL PERMISSIONS"); } catch (InvalidRequestException e) { log.error("authorizer does not support listing: {}", e.getMessage()); }

When it happens

Trigger: Calling LIST PERMISSIONS (any variant) while the authorizer (cassandra.yaml authorizer setting, e.g. AllowAllAuthorizer or a minimal custom IAuthorizer) throws UnsupportedOperationException from list().

Common situations: Clusters still on default AllowAllAuthorizer where someone runs LIST PERMISSIONS; after migrating authorizers without restarting all nodes; custom authorizer implementations that never implemented list().

Understand the failure class

Background: UnsupportedOperationException and "is not supported" errors: when a library deliberately refuses a call — this error's family across 30 libraries.

Related errors

• Load CIDR groups cache operation not supported by %s
• native_transport_max_frame_size must be positive value < %dB
• No accord transaction should be executed when accord.enabled
• Altering field types is no longer supported
• Cannot use CREATE TABLE LIKE on an index table '%s.%s'.

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/dbbc96c3b9a307c1. Report an issue: GitHub.