apache/cassandra · error · UnauthorizedException

You have to be logged in and not anonymous to perform this…

Error message

You have to be logged in and not anonymous to perform this request

What it means

UnauthorizedException thrown by ClientState.ensureNotAnonymous() when the request is executed by an anonymous user (e.g. under AllowAllAuthenticator) but the operation requires a concrete non-anonymous identity, such as creating or altering roles, or other operations that must be attributed to a real authenticated user.

Solutions

Enable a real authenticator (e.g. PasswordAuthenticator) in cassandra.yaml and connect with actual credentials.
Log in as a named, non-anonymous role before performing role/user management operations.
Do not attempt CREATE ROLE/USER on a cluster running AllowAllAuthenticator; identity is not meaningful there.
Verify client connection settings so the driver actually authenticates rather than falling back to anonymous access.

Example fix

// before (no credentials, anonymous session)
session.execute("CREATE ROLE app WITH PASSWORD = 'x' AND LOGIN = true");
// after
CqlSession admin = CqlSession.builder().addContactPoint(addr)
    .withAuthCredentials("cassandra", "cassandra").build();
admin.execute("CREATE ROLE app WITH PASSWORD = 'x' AND LOGIN = true");

Defensive patterns

Strategy: try-catch

Validate before calling

// Verify authentication is enabled and credentials are set before role management:
if (!authEnabled) throw new IllegalStateException("Role management requires PasswordAuthenticator or similar");

Try / catch

try {
    session.execute("CREATE ROLE ... ");
} catch (com.datastax.oss.driver.api.core.servererrors.UnauthorizedException e) {
    if (e.getMessage().contains("not anonymous")) {
        session = authenticatedSession(adminCredentials); // reconnect with real credentials
    } else throw e;
}

Prevention

Run role-management tooling only with authenticated admin sessions.
Do not mix AllowAllAuthenticator clusters with identity-dependent operations.
Assert non-anonymous user in tooling bootstrap before issuing role statements.

When it happens

Trigger: Executing statements requiring ensureNotAnonymous() (e.g. CREATE ROLE/USER, requests needing a real identity) while connected via AllowAllAuthenticator or an anonymous login; calling ensureNotAnonymous() from ClientState.validate() paths when user.isAnonymous() is true.

Common situations: Clusters switched to PasswordAuthenticator server-side but clients still connecting without credentials resolving to anonymous access; attempting user management on an auth-disabled cluster; tools creating roles during bootstrap on a cluster without real authentication.

Related errors

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/c7895637b51c9ff9. Report an issue: GitHub.

Appendix: source

Thrown at src/java/org/apache/cassandra/service/ClientState.java:621

        {
            throw new UnauthorizedException("You have not logged in");
        }
        else if (!user.hasLocalAccess())
        {
            throw new UnauthorizedException(String.format("You do not have access to this datacenter (%s)", Datacenters.thisDatacenter()));
        }
        else
        {
            if (remoteAddress != null && !user.hasAccessFromIp(remoteAddress))
                throw new UnauthorizedException("You do not have access from this IP " + remoteAddress.getHostString());
        }
    }

    public void ensureNotAnonymous()
    {
        validateLogin();
        if (user.isAnonymous())
            throw new UnauthorizedException("You have to be logged in and not anonymous to perform this request");
    }

    /**
     * Checks if this user is an ordinary user (not a super or system user).
     *
     * @return {@code true} if this user is an ordinary user, {@code false} otherwise.
     */
    public boolean isOrdinaryUser()
    {
        return !isSystem() && !isSuper();
    }

    /**
     * Checks if this user is a super user.
     */
    public boolean isSuper()
    {
        if (!DatabaseDescriptor.isAuthenticationRequired())

View on GitHub (pinned to 88fd0f6a0e)