apache/cassandra · error · UnauthorizedException

You do not have access to this datacenter

Error message

You do not have access to this datacenter (%s)

What it means

UnauthorizedException thrown by ClientState.validateLogin() when the authenticated user exists but does not have access to the datacenter the request is being served in. AuthenticatedUser.hasLocalAccess() checks DC-scoped access (e.g. configured dc-specific access control), and clients denied in the local DC are rejected.

Solutions

1. Grant the role access to the target datacenter (e.g. via role options / ACCESS TO DATACENTERS where supported) or login as a role scoped to that DC.
2. Configure the driver's load-balancing policy with localDc set to a DC the user can access.
3. Check Datacenters.thisDatacenter() on the node to confirm the node's DC matches the intended access grants.
4. Review authentication/role configuration after any DC rename or topology change.

Example fix

// before (driver points at restricted DC)
.withLocalDc("dc_restricted")
// after
.withLocalDc("dc_allowed").addContactPoint(nodeInDcAllowed);

// Before connecting, confirm the intended DC is one the role may access:
// nodetool describecluster / system.local: check data_center on the node
String dc = session.execute("SELECT data_center FROM system.local").one().getString("data_center");
if (!allowedDatacenters.contains(dc)) throw new IllegalStateException("Role not authorized in DC " + dc);

When it happens

Trigger: A user authenticated successfully but whose roles/credentials do not grant access to Datacenters.thisDatacenter(); connecting to a node in a DC the user is not authorized for, e.g. after cross-DC role restrictions were configured; client redirected or driver discovered a node in a restricted DC.

Common situations: Multi-datacenter deployments where roles were provisioned only for one DC but the driver's contact points round-robin into another; after moving/rehoming nodes between DCs; misconfigured DSE/Cassandra DC-aware access policies.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• You do not have access from this IP
• Access denied
• Access Denied
• Auth check after connection closed
• Authentication error

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/3316b6fabb6dfe2a. Report an issue: GitHub.

Appendix: source

Thrown at src/java/org/apache/cassandra/service/ClientState.java:608

        {
            // allow users with sufficient privileges to alter replication params of replicated system keyspaces
            if (perm == Permission.ALTER && resource.isKeyspaceLevel())
                return;

            // prevent all other modifications of replicated system keyspaces
            throw new UnauthorizedException(String.format("Cannot %s %s", perm, resource));
        }
    }

    public void validateLogin()
    {
        if (user == null)
        {
            throw new UnauthorizedException("You have not logged in");
        }
        else if (!user.hasLocalAccess())
        {
            throw new UnauthorizedException(String.format("You do not have access to this datacenter (%s)", Datacenters.thisDatacenter()));
        }
        else
        {
            if (remoteAddress != null && !user.hasAccessFromIp(remoteAddress))
                throw new UnauthorizedException("You do not have access from this IP " + remoteAddress.getHostString());
        }
    }

    public void ensureNotAnonymous()
    {
        validateLogin();
        if (user.isAnonymous())
            throw new UnauthorizedException("You have to be logged in and not anonymous to perform this request");
    }

    /**
     * Checks if this user is an ordinary user (not a super or system user).
     *

View on GitHub (pinned to 88fd0f6a0e)