apache/cassandra · error · UnauthorizedException

User has no permission on or any of its parents

Error message

User %s has no %s permission on %s or any of its parents

What it means

ensurePermissionOnResourceChain walks the resource and its parents (e.g. table -> keyspace -> ALL KEYSPACES) and throws UnauthorizedException if the authenticated user's granted permissions on none of them include the required permission. This is the standard 'you lack a privilege' error returned to CQL clients.

Solutions

1. Grant the missing permission: `GRANT <PERM> ON <resource> TO <role>` (e.g. GRANT SELECT ON keyspace.table TO app).
2. Grant at a coarser level if appropriate: `GRANT SELECT ON KEYSPACE ks TO app` or `GRANT SELECT ON ALL KEYSPACES TO app`.
3. Inspect current grants: `LIST ALL PERMISSIONS OF <role>` and `LIST ROLES OF <role>`, then fill the gap.
4. Connect with a role that has the needed permission, or have a superuser perform the operation.

Example fix

// before
-- as role 'reporting'
SELECT * FROM metrics.samples; -- Unauthorized
// after (as superuser)
GRANT SELECT ON KEYSPACE metrics TO reporting;

Row perms = session.execute("LIST ALL PERMISSIONS OF %s", role) != null
    ? null : null; // use: LIST PERMISSIONS output to confirm required perm before issuing statement

try { session.execute(cql); } catch (UnauthorizedException e) {
    if (e.getMessage().contains("has no ")) {
        logger.error("Missing grant: {}", e.getMessage());
        // request GRANT of the named permission on the named resource
    }
}

When it happens

Trigger: A statement requiring a permission the user was never granted — e.g. a non-superuser running `SELECT` on a table without any SELECT/SELECT-on-keyspace/SELECT-on-all-keyspaces grant, or `CREATE TABLE` in a keyspace without CREATE permission there.

Common situations: New application role provisioned without GRANTs; permission revoked during an incident and clients not updated; role assumptions after a rename; connecting as a role with privileges on a different keyspace than the statement targets.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• Granting permissions on system keyspaces is strictly…
• Only superusers can drop a role with superuser status
• You are not authorized to view roles granted to
• You are not authorized to view superuser details
• Altering permissions on builtin functions is not supported

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/83ba680d2d1de4b8. Report an issue: GitHub.

Appendix: source

Thrown at src/java/org/apache/cassandra/service/ClientState.java:573

                                                                              function.argTypes()));
    }

    private void ensurePermissionOnResourceChain(Permission perm, IResource resource)
    {
        ensurePermissionOnResourceChain(perm, Resources.chain(resource));
    }

    private void ensurePermissionOnResourceChain(Permission perm, List<? extends IResource> resources)
    {
        IResource resource = resources.get(0);
        if (DatabaseDescriptor.getAuthFromRoot())
            resources = Lists.reverse(resources);

        for (IResource r : resources)
            if (authorize(r).contains(perm))
                return;

        throw new UnauthorizedException(String.format("User %s has no %s permission on %s or any of its parents",
                                                      user.getName(),
                                                      perm,
                                                      resource));
    }

    private void preventSystemKSSchemaModification(String keyspace, DataResource resource, Permission perm)
    {
        // we only care about DDL statements
        if (perm != Permission.ALTER && perm != Permission.DROP && perm != Permission.CREATE)
            return;

        // prevent ALL local system keyspace modification
        if (SchemaConstants.isLocalSystemKeyspace(keyspace))
            throw new UnauthorizedException(keyspace + " keyspace is not user-modifiable.");

        if (SchemaConstants.isReplicatedSystemKeyspace(keyspace))
        {
            // allow users with sufficient privileges to alter replication params of replicated system keyspaces

View on GitHub (pinned to 88fd0f6a0e)