apache/cassandra · error · UnauthorizedException

Unable to perform authorization of login permission:

Error message

Unable to perform authorization of login permission: 

What it means

UnauthorizedException from canLogin(): determining whether the role may log in failed because the read of the role row from system_auth.roles threw a RequestExecutionException. As with isSuper, this indicates the auth tables could not be read at QUORUM — it does not mean login is denied.

Solutions

1. Bring enough system_auth replicas back online for QUORUM reads and retry
2. Increase system_auth replication factor in each datacenter
3. Check the chained exception for the underlying read failure

When it happens

Trigger: Thrown at src/java/org/apache/cassandra/auth/CassandraRoleManager.java:504 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/1803409ae6667430. Report an issue: GitHub.

Appendix: source

Thrown at src/java/org/apache/cassandra/auth/CassandraRoleManager.java:504

            return getRole(role.getRoleName()).isSuper;
        }
        catch (RequestExecutionException e)
        {
            logger.debug("Failed to authorize {} for super-user permission", role.getRoleName());
            throw new UnauthorizedException("Unable to perform authorization of super-user permission: " + e.getMessage(), e);
        }
    }

    public boolean canLogin(RoleResource role)
    {
        try
        {
            return getRole(role.getRoleName()).canLogin;
        }
        catch (RequestExecutionException e)
        {
            logger.debug("Failed to authorize {} for login permission", role.getRoleName());
            throw new UnauthorizedException("Unable to perform authorization of login permission: " + e.getMessage(), e);
        }
    }

    public Map<String, String> getCustomOptions(RoleResource role)
    {
        return Collections.emptyMap();
    }

    public boolean isExistingRole(RoleResource role)
    {
        return !Roles.isNullRole(getRole(role.getRoleName()));
    }

    public Set<? extends IResource> protectedResources()
    {
        return Set.of(DataResource.table(SchemaConstants.AUTH_KEYSPACE_NAME, AuthKeyspace.ROLES),
                      DataResource.table(SchemaConstants.AUTH_KEYSPACE_NAME, AuthKeyspace.ROLE_MEMBERS));
    }

View on GitHub (pinned to 88fd0f6a0e)