apache/cassandra · error · UnauthorizedException

Unable to perform authorization of permissions

Error message

Unable to perform authorization of permissions: %s

What it means

Not an authorization denial: authorize() wraps a RequestExecutionException raised while reading role permissions from the system_auth tables (roles/role_permissions). It fires when the auth query itself fails — e.g. insufficient replication, unavailable nodes, or consistency timeouts at authReadConsistencyLevel — leaving Cassandra unable to determine the user's permissions.

Solutions

1. Check availability of the nodes holding system_auth replicas and retry once the cluster is healthy
2. Increase replication factor of system_auth so reads at QUORUM/local auth consistency can succeed
3. Inspect the debug log line 'Failed to authorize ...' for the underlying read failure

When it happens

Trigger: Thrown at src/java/org/apache/cassandra/auth/CassandraAuthorizer.java:111 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/637bfef51406d356. Report an issue: GitHub.

Appendix: source

Thrown at src/java/org/apache/cassandra/auth/CassandraAuthorizer.java:111

    public Set<Permission> authorize(AuthenticatedUser user, IResource resource)
    {
        try
        {
            if (user.isSuper())
                return resource.applicablePermissions();

            Set<Permission> permissions = EnumSet.noneOf(Permission.class);

            // Even though we only care about the RoleResource here, we use getRoleDetails as
            // it saves a Set creation in RolesCache
            for (Role role: user.getRoleDetails())
                addPermissionsForRole(permissions, resource, role.resource);
            return permissions;
        }
        catch (RequestExecutionException | RequestValidationException e)
        {
            logger.debug("Failed to authorize {} for {}", user, resource);
            throw new UnauthorizedException("Unable to perform authorization of permissions: " + e.getMessage(), e);
        }
    }

    public Set<Permission> grant(AuthenticatedUser performer, Set<Permission> permissions, IResource resource, RoleResource grantee)
    throws RequestValidationException, RequestExecutionException
    {
        String roleName = escapeCqlLiteral(grantee.getRoleName());
        String resourceName = escapeCqlLiteral(resource.getName());
        Set<Permission> existingPermissions = getExistingPermissions(roleName, resourceName, permissions);
        Set<Permission> nonExistingPermissions = Sets.difference(permissions, existingPermissions);

        if (!nonExistingPermissions.isEmpty())
        {
            modifyRolePermissions(nonExistingPermissions, resource, grantee, "+");
            addLookupEntry(resource, grantee);
        }

        return nonExistingPermissions;

View on GitHub (pinned to 88fd0f6a0e)