apache/cassandra · error · UnauthorizedException

You have not logged in

Error message

You have not logged in

What it means

UnauthorizedException thrown by ClientState.validateLogin() when the client state has no authenticated user, i.e. no LOGIN/execution happened after authenticating, or authentication was skipped. Cassandra requires a logged-in AuthenticatedUser before authorizing statements when auth is enabled.

Solutions

1. Log in before executing statements: provide credentials in the driver's auth provider configuration.
2. Verify cassandra.yaml authenticator is consistent with your client setup (Authenticator vs AllowAllAuthenticator).
3. For protocol-level clients, complete the AUTHENTICATE/AUTH_RESPONSE message exchange before QUERY messages.
4. If authentication is intentionally not used, set authenticator and authorizer to AllowAll* in cassandra.yaml and restart.

Example fix

// before
CqlSession session = CqlSession.builder().addContactPoint(addr).build();
// after
CqlSession session = CqlSession.builder().addContactPoint(addr)
    .withAuthCredentials("user", "password").build();

try {
    session.execute(query);
} catch (com.datastax.oss.driver.api.core.servererrors.UnauthorizedException e) {
    if (e.getMessage().contains("not logged in")) {
        session = loginAndReconnect(credentials); // re-authenticate then retry
    } else throw e;
}

When it happens

Trigger: Sending statements on a connection without a preceding successful AUTHENTICATE/login handshake; calling ClientState.validateLogin() (directly or via ensurePermission/authorize/hasTablePermission) while user == null; using a driver connection created without credentials against an auth-enabled cluster.

Common situations: Driver misconfiguration missing credentials (no auth provider) against a cluster with authenticator: PasswordAuthenticator; custom clients speaking CQL binary protocol that skip the STARTUP/AUTHENTICATE exchange; sessions created before login in embedded tooling.

Related errors

• Cannot DROP primary role for current login
• Error: invalid password hash encountered, rejecting user
• You have not set a keyspace for this session
• A TTL must be greater or equal to 0, but was
• A user type cannot contain counters

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/36d2a4c10c692dbe. Report an issue: GitHub.

Appendix: source

Thrown at src/java/org/apache/cassandra/service/ClientState.java:604

        if (SchemaConstants.isLocalSystemKeyspace(keyspace))
            throw new UnauthorizedException(keyspace + " keyspace is not user-modifiable.");

        if (SchemaConstants.isReplicatedSystemKeyspace(keyspace))
        {
            // allow users with sufficient privileges to alter replication params of replicated system keyspaces
            if (perm == Permission.ALTER && resource.isKeyspaceLevel())
                return;

            // prevent all other modifications of replicated system keyspaces
            throw new UnauthorizedException(String.format("Cannot %s %s", perm, resource));
        }
    }

    public void validateLogin()
    {
        if (user == null)
        {
            throw new UnauthorizedException("You have not logged in");
        }
        else if (!user.hasLocalAccess())
        {
            throw new UnauthorizedException(String.format("You do not have access to this datacenter (%s)", Datacenters.thisDatacenter()));
        }
        else
        {
            if (remoteAddress != null && !user.hasAccessFromIp(remoteAddress))
                throw new UnauthorizedException("You do not have access from this IP " + remoteAddress.getHostString());
        }
    }

    public void ensureNotAnonymous()
    {
        validateLogin();
        if (user.isAnonymous())
            throw new UnauthorizedException("You have to be logged in and not anonymous to perform this request");
    }

View on GitHub (pinned to 88fd0f6a0e)