apache/cassandra · error · UnauthorizedException

You do not have access from this IP

Error message

You do not have access from this IP ${remoteAddress.getHostString()}

What it means

UnauthorizedException thrown by ClientState.validateLogin() when the user is authenticated and DC-allowed but the client's source IP is not among the IPs the user is permitted to connect from (AuthenticatedUser.hasAccessFromIp fails, e.g. due to IP-based access restrictions on the role).

Solutions

1. Update the role's allowed IP/CIDR list to include the client's source address (re-run the network access grant).
2. Login with a role that has no IP restrictions, or create a dedicated role for the new host.
3. Verify what source IP the node sees (getRemoteAddress / logs) — NAT may mask the original IP.
4. In dynamic environments (K8s), either broaden the allowlist to the pod network CIDR or pin egress IPs.

Example fix

// before: role restricted to 10.0.1.0/24, client at 10.0.5.7
// after: extend grant
GRANT EXECUTE ON ALL QUERIES TO app_role WITH RESTRICTION; -- include 10.0.5.0/24 in role's network allowlist

InetAddress clientIp = InetAddress.getLocalHost(); // the egress IP as seen by the node
if (!roleAllowedCidrs.contains(clientIp))
    throw new IllegalStateException("Client IP " + clientIp + " not in role allowlist");

When it happens

Trigger: Connecting from a client IP not listed in the role's allowed networks (network-authorizer / role IP allowlist); running an application from a new host, container, or after NAT change so its IP no longer matches the configured allowlist.

Common situations: After moving workloads into containers/Kubernetes where pod IPs are dynamic; firewall/NAT changes altering the apparent client IP; provisioning a role with CIDR restrictions then deploying from an unplanned subnet.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• You do not have access to this datacenter
• Access denied
• Access Denied
• Auth check after connection closed
• Authentication error

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/a88b1c354c2bef29. Report an issue: GitHub.

Appendix: source

Thrown at src/java/org/apache/cassandra/service/ClientState.java:613

            // prevent all other modifications of replicated system keyspaces
            throw new UnauthorizedException(String.format("Cannot %s %s", perm, resource));
        }
    }

    public void validateLogin()
    {
        if (user == null)
        {
            throw new UnauthorizedException("You have not logged in");
        }
        else if (!user.hasLocalAccess())
        {
            throw new UnauthorizedException(String.format("You do not have access to this datacenter (%s)", Datacenters.thisDatacenter()));
        }
        else
        {
            if (remoteAddress != null && !user.hasAccessFromIp(remoteAddress))
                throw new UnauthorizedException("You do not have access from this IP " + remoteAddress.getHostString());
        }
    }

    public void ensureNotAnonymous()
    {
        validateLogin();
        if (user.isAnonymous())
            throw new UnauthorizedException("You have to be logged in and not anonymous to perform this request");
    }

    /**
     * Checks if this user is an ordinary user (not a super or system user).
     *
     * @return {@code true} if this user is an ordinary user, {@code false} otherwise.
     */
    public boolean isOrdinaryUser()
    {
        return !isSystem() && !isSuper();

View on GitHub (pinned to 88fd0f6a0e)