apache/cassandra · error · UnauthorizedException

You are not authorized to view superuser details

Error message

You are not authorized to view superuser details

What it means

LIST SUPERUSERS requires the caller to hold DESCRIBE permission on the root role resource ('all roles'); the authorize() check throws UnauthorizedException otherwise. This limits visibility of superuser accounts to privileged roles.

Source

Thrown at src/java/org/apache/cassandra/cql3/statements/ListSuperUsersStatement.java:72

    public ListSuperUsersStatement()
    {
        // nothing to do
    }

    public void validate(ClientState state) throws UnauthorizedException, InvalidRequestException
    {
        state.ensureNotAnonymous();
    }

    public void authorize(ClientState state) throws InvalidRequestException
    {
        // Allow listing superuser privileged users only if the caller has DESCRIBE permission on 'all roles'
        if (!DatabaseDescriptor.getAuthorizer()
                               .authorize(state.getUser(), RoleResource.root())
                               .contains(Permission.DESCRIBE))
        {
            throw new UnauthorizedException("You are not authorized to view superuser details");
        }
    }

    public ResultMessage execute(ClientState state) throws RequestValidationException, RequestExecutionException
    {
        Set<RoleResource> superUsers = Roles.getAllRoles(Roles::hasSuperuserStatus);
        if (superUsers == null || superUsers.isEmpty())
            return new ResultMessage.Void();

        ResultSet result = new ResultSet(new ResultSet.ResultMetadata(metadata));

        superUsers.stream()
                  .sorted(RoleResource::compareTo)
                  .forEach(role -> result.addColumnValue(UTF8Type.instance.decompose(role.getRoleName())));

        return new ResultMessage.Rows(result);
    }

View on GitHub (pinned to 88fd0f6a0e)

Solutions

1. Have a superuser run: GRANT DESCRIBE ON ALL ROLES TO <user>, then retry
2. Run LIST SUPERUSERS with superuser credentials
3. Query via a role that is part of the superuser chain instead

Example fix

// before
LIST SUPERUSERS; // as app_user -> UnauthorizedException
// after
-- as superuser
GRANT DESCRIBE ON ALL ROLES TO app_user;
-- then as app_user
LIST SUPERUSERS;

boolean hasDescribe = DatabaseDescriptor.getAuthorizer()
    .authorize(user, RoleResource.root()).contains(Permission.DESCRIBE);
if (!hasDescribe) throw new IllegalStateException("LIST SUPERUSERS requires DESCRIBE on all roles");

try { session.execute("LIST SUPERUSERS"); } catch (UnauthorizedException e) { log.warn("insufficient permissions for LIST SUPERUSERS: {}", e.getMessage()); }

When it happens

Trigger: Any authenticated user without DESCRIBE on RoleResource.root() executes LIST SUPERUSERS (authorizer must return a permission set for root that lacks DESCRIBE).

Common situations: Regular application roles running LIST SUPERUSERS during debugging; monitoring scripts using under-privileged credentials; clusters on AllowAllAuthorizer migrated to CassandraAuthorizer where permissions were never granted.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• Only superusers can drop a role with superuser status
• You are not authorized to view roles granted to %s
• You aren't allowed to alter %s
• %s doesn't exist
• Cannot DROP primary role for current login

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/a1ea926e7aff4166. Report an issue: GitHub.