apache/cassandra · error · UnauthorizedException

Unable to perform authorization of super-user permission:

Error message

Unable to perform authorization of super-user permission: 

What it means

UnauthorizedException from isSuper(): the super-user status could not be determined because reading the role row from system_auth.roles failed with a RequestExecutionException. The debug line 'Failed to authorize ... for super-user permission' names the role; the error signals an auth-table read failure, not a negative answer.

Solutions

1. Restore availability of system_auth replicas (the read uses QUORUM) and retry
2. Raise the system_auth replication factor to span more nodes per DC
3. Investigate the chained RequestExecutionException for the true cause (timeout, unavailable, etc.)

When it happens

Trigger: Thrown at src/java/org/apache/cassandra/auth/CassandraRoleManager.java:491 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/53b441e32558761f. Report an issue: GitHub.

Appendix: source

Thrown at src/java/org/apache/cassandra/auth/CassandraRoleManager.java:491

        ImmutableSet.Builder<RoleResource> builder = ImmutableSet.builder();
        UntypedResultSet rows = process(String.format("SELECT role from %s.%s",
                                                      SchemaConstants.AUTH_KEYSPACE_NAME,
                                                      AuthKeyspace.ROLES),
                                        ConsistencyLevel.QUORUM);
        rows.forEach(row -> builder.add(RoleResource.role(row.getString("role"))));
        return builder.build();
    }

    public boolean isSuper(RoleResource role)
    {
        try
        {
            return getRole(role.getRoleName()).isSuper;
        }
        catch (RequestExecutionException e)
        {
            logger.debug("Failed to authorize {} for super-user permission", role.getRoleName());
            throw new UnauthorizedException("Unable to perform authorization of super-user permission: " + e.getMessage(), e);
        }
    }

    public boolean canLogin(RoleResource role)
    {
        try
        {
            return getRole(role.getRoleName()).canLogin;
        }
        catch (RequestExecutionException e)
        {
            logger.debug("Failed to authorize {} for login permission", role.getRoleName());
            throw new UnauthorizedException("Unable to perform authorization of login permission: " + e.getMessage(), e);
        }
    }

    public Map<String, String> getCustomOptions(RoleResource role)
    {

View on GitHub (pinned to 88fd0f6a0e)