apache/cassandra · error · AuthenticationException

Unable to perform authentication: ${e.getMessage()}

Error message

Unable to perform authentication: ${e.getMessage()}

What it means

canLogin wraps user.canLogin() and converts RequestExecutionException/RequestValidationException (e.g. timeouts or consistency failures reading system_auth during login) into AuthenticationException with the message 'Unable to perform authentication: ...'. It signals that login could not be EVALUATED because the underlying auth lookup failed, as opposed to an explicit denial.

Source

Thrown at src/java/org/apache/cassandra/service/ClientState.java:428

    {
        if (user.isAnonymous() || canLogin(user))
        {
            this.user = user;
            this.superuserStatus = null;
        }
        else
            throw new AuthenticationException(String.format("%s is not permitted to log in", user.getName()));
    }

    private boolean canLogin(AuthenticatedUser user)
    {
        try
        {
            return user.canLogin();
        }
        catch (RequestExecutionException | RequestValidationException e)
        {
            throw new AuthenticationException("Unable to perform authentication: " + e.getMessage(), e);
        }
    }

    public void ensureAllKeyspacesPermission(Permission perm)
    {
        if (isInternal)
            return;
        validateLogin();
        ensurePermission(perm, DataResource.root());
    }

    public void ensureKeyspacePermission(String keyspace, Permission perm)
    {
        ensurePermission(keyspace, perm, DataResource.keyspace(keyspace));
    }

    public void ensureAllTablesPermission(String keyspace, Permission perm)
    {

View on GitHub (pinned to 88fd0f6a0e)

Solutions

  1. Repair system_auth: `nodetool repair -pr system_auth` on all nodes; ensure its RF matches cluster topology and all replicas are up.
  2. Bring the failed replicas back online so the QUORUM read of roles succeeds.
  3. Check `nodetool describecluster`/logs for schema disagreement and resolve it (RequestValidationException path).
  4. Retry the login once the auth tables are healthy; escalate persistent timeouts with auth read consistency adjustments.

Example fix

// before
cqlsh -u admin -p pass # Unable to perform authentication: Operation timed out
// after
nodetool repair -pr system_auth   # on every node
cqlsh -u admin -p pass
Defensive patterns

Strategy: retry

Validate before calling

// pre-check auth table availability
ResultSet rs = session.execute("SELECT role FROM system_auth.roles LIMIT 1");
if (rs.wasApplied() == false || rs == null) logger.warn("system_auth unavailable; logins will fail");

Try / catch

try { client.connect(u, p); } catch (AuthenticationException e) {
    if (e.getMessage().startsWith("Unable to perform authentication")) {
        backoffRetry(connect, 3);
        scheduleSystemAuthRepair();
    }
}

Prevention

When it happens

Trigger: Reading the role's login state from system_auth fails: RequestTimeoutException / UnavailableException due to insufficient replicas (under-replicated system_auth, a node down), or a RequestValidationException from a corrupt/missing auth table.

Common situations: system_auth lost replication after a node failure so role queries time out at QUORUM; cluster recovered from backup without system_auth data; heavy GC/overload causing auth read timeouts during login.

Understand the failure class

Related errors

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/9707216e1d098152. Report an issue: GitHub.