apache/cassandra · error · UnauthorizedException

You are not authorized to view

Error message

You are not authorized to view %s's permissions

What it means

Thrown by CassandraAuthorizer.list when a LIST PERMISSIONS request targets another user's permissions but the performer is not a superuser, is not the grantee, and lacks the DESCRIBE permission on the target role (or on all roles). It is a privilege check on the metadata request, not a failure of the underlying data.

Solutions

1. Run LIST PERMISSIONS as a superuser
2. List only the performer's own permissions (omit the OF clause or use their own role)
3. Grant the performer DESCRIBE on the target role (or ALL ROLES) so the metadata is visible

When it happens

Trigger: Thrown at src/java/org/apache/cassandra/auth/CassandraAuthorizer.java:344 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/b8cd506cca23b13d. Report an issue: GitHub.

Appendix: source

Thrown at src/java/org/apache/cassandra/auth/CassandraAuthorizer.java:344

                authWriteConsistencyLevel());
    }

    // 'grantee' can be null - in that case everyone's permissions have been requested. Otherwise, only single user's.
    // If the 'performer' requesting 'LIST PERMISSIONS' is not a superuser OR their username doesn't match 'grantee' OR
    // they have no permission to describe all roles OR they have no permission to describe 'grantee', then we throw
    // UnauthorizedException.
    public Set<PermissionDetails> list(AuthenticatedUser performer,
                                       Set<Permission> permissions,
                                       IResource resource,
                                       RoleResource grantee)
    throws RequestValidationException, RequestExecutionException
    {
        if (!performer.isSuper()
            && !performer.isSystem()
            && !performer.getRoles().contains(grantee)
            && !performer.getPermissions(RoleResource.root()).contains(Permission.DESCRIBE)
            && (grantee == null || !performer.getPermissions(grantee).contains(Permission.DESCRIBE)))
            throw new UnauthorizedException(String.format("You are not authorized to view %s's permissions",
                                                          grantee == null ? "everyone" : grantee.getRoleName()));

        if (null == grantee)
            return listPermissionsForRole(permissions, resource, null);

        Set<RoleResource> roles = DatabaseDescriptor.getRoleManager().getRoles(grantee, true);
        Set<PermissionDetails> details = new HashSet<>();
        for (RoleResource role : roles)
            details.addAll(listPermissionsForRole(permissions, resource, role));

        return details;
    }

    private Set<PermissionDetails> listPermissionsForRole(Set<Permission> permissions,
                                                          IResource resource,
                                                          RoleResource role)
    throws RequestExecutionException
    {

View on GitHub (pinned to 88fd0f6a0e)