apache/cassandra · error · UnauthorizedException

User %s does not have sufficient privileges to perform the r

Error message

User %s does not have sufficient privileges to perform the requested operation

What it means

AuthenticationStatement.checkPermission catches the underlying UnauthorizedException from state.ensurePermission and rethrows it as a friendlier message naming the user, hiding resource/permission specifics. It means the authenticated user lacks the required Permission on the resource.

Source

Thrown at src/java/org/apache/cassandra/cql3/statements/AuthenticationStatement.java:64

    public abstract ResultMessage execute(ClientState state) throws RequestExecutionException, RequestValidationException;

    @Override
    public ResultMessage executeLocally(QueryState state, QueryOptions options)
    {
        // executeLocally is for local query only, thus altering users doesn't make sense and is not supported
        throw new UnsupportedOperationException();
    }

    public void checkPermission(ClientState state, Permission required, RoleResource resource) throws UnauthorizedException
    {
        try
        {
            state.ensurePermission(required, resource);
        }
        catch (UnauthorizedException e)
        {
            // Catch and rethrow with a more friendly message
            throw new UnauthorizedException(String.format("User %s does not have sufficient privileges " +
                                                          "to perform the requested operation",
                                                          state.getUser().getName()));
        }
    }

    public String obfuscatePassword(String query)
    {
        return query;
    }
}

View on GitHub (pinned to 88fd0f6a0e)

Solutions

Grant the required permission: a superuser runs GRANT ALTER ON ROLE <role> TO <user> (or the appropriate permission/resource)
Perform the operation as a superuser
Audit the user's effective permissions with LIST ALL PERMISSIONS OF <user> and adjust grants

Example fix

// before
ALTER ROLE other_role WITH PASSWORD = 'x'; // UnauthorizedException
// after
-- as superuser first:
GRANT ALTER ON ROLE other_role TO my_admin;
-- then as my_admin:
ALTER ROLE other_role WITH PASSWORD = 'x';

Defensive patterns

Strategy: try-catch

Validate before calling

// pre-check effective permissions
ResultSet rs = session.execute("LIST ALL PERMISSIONS OF " + user);
boolean allowed = rs.all().stream().anyMatch(row -> row.getString("permission").equals("ALTER") && resourceMatches(row, resource));

Try / catch

try { session.execute(stmt); }
catch (com.datastax.driver.core.exceptions.UnauthorizedException e) {
    if (e.getMessage().contains("does not have sufficient privileges")) { auditGrants(user); }
}

Prevention

Run LIST ALL PERMISSIONS OF <user> to audit grants before privileged operations
Grant the exact permission on the exact resource (GRANT ALTER ON ROLE x TO y)
Remember this handler masks the underlying resource detail — use server logs for diagnostics

When it happens

Trigger: Any auth-related CQL statement (CREATE/ALTER/DROP ROLE or USER, GRANT/REVOKE, LIST permissions) whose checkPermission finds the user lacks the required permission on the target resource — e.g. ALTER on a role you don't own without explicit ALTER permission.

Common situations: Granting a role ALTER on some resources but not the target; typo in role name causing permission lookup against wrong resource; permission caches stale after REVOKE (use LIST ALL PERMISSIONS OF user to audit).

Understand the failure class

Background: "You do not have permission" / 403 Forbidden errors: authenticated but not allowed — causes and fixes across open-source libraries — this error's family across 31 libraries.

Related errors

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/bd94fff6bfe91de9. Report an issue: GitHub.