{"record":{"id":"0a8708718fbfb186","repo":"apache/cassandra","slug":"s-is-not-permitted-to-log-in","errorCode":null,"errorMessage":"%s is not permitted to log in","messagePattern":"(.+?) is not permitted to log in","errorType":"exception","errorClass":"AuthenticationException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/service/ClientState.java","lineNumber":417,"sourceCode":"        // Skip keyspace validation for non-authenticated users. Apparently, some client libraries\n        // call set_keyspace() before calling login(), and we have to handle that.\n        if (user != null && Schema.instance.getKeyspaceMetadata(ks) == null)\n            throw new InvalidRequestException(\"Keyspace '\" + ks + \"' does not exist\");\n        keyspace = ks;\n    }\n\n    /**\n     * Attempts to login the given user.\n     */\n    public void login(AuthenticatedUser user)\n    {\n        if (user.isAnonymous() || canLogin(user))\n        {\n            this.user = user;\n            this.superuserStatus = null;\n        }\n        else\n            throw new AuthenticationException(String.format(\"%s is not permitted to log in\", user.getName()));\n    }\n\n    private boolean canLogin(AuthenticatedUser user)\n    {\n        try\n        {\n            return user.canLogin();\n        }\n        catch (RequestExecutionException | RequestValidationException e)\n        {\n            throw new AuthenticationException(\"Unable to perform authentication: \" + e.getMessage(), e);\n        }\n    }\n\n    public void ensureAllKeyspacesPermission(Permission perm)\n    {\n        if (isInternal)\n            return;","sourceCodeStart":399,"sourceCodeEnd":435,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/service/ClientState.java#L399-L435","documentation":"ClientState.login() accepts an AuthenticatedUser only if the user is anonymous or canLogin() succeeds (the role exists and is not disabled); otherwise it throws AuthenticationException stating the user is not permitted to log in. This covers roles that were deleted or had LOGIN disabled after a client obtained credentials.","triggerScenarios":"Authenticating credentials whose role row is missing from system_auth.roles, or whose can_login flag is false; calling login(user) for a role that was disabled via `ALTER ROLE x WITH LOGIN = false`.","commonSituations":"User logged in after an operator ran `ALTER ROLE app WITH LOGIN = false`; role dropped while the client still uses its credentials; LDAP/external auth mapping to a role that doesn't exist in Cassandra; cidr/IP restrictions rejecting the login (canLogin false).","solutions":["Re-enable the role: `ALTER ROLE <name> WITH LOGIN = true`.","Recreate the missing role: `CREATE ROLE <name> WITH PASSWORD = ... AND LOGIN = true`.","Check CIDR group restrictions (cidr_groups / authorizer settings) that may block the role's login.","Verify the authenticator's stored credentials exist in system_auth (repair system_auth if replication was broken)."],"exampleFix":"// before\ncqlsh -u appsvc -p secret # AuthenticationException: appsvc is not permitted to log in\n// after (as superuser)\nALTER ROLE appsvc WITH LOGIN = true;","handlingStrategy":"try-catch","validationCode":"// as superuser, before deploying credentials:\nRow r = session.execute(\"SELECT can_login FROM system_auth.roles WHERE role = ?\", role).one();\nboolean canLogin = r != null && r.getBool(\"can_login\");","typeGuard":null,"tryCatchPattern":"try { client.connect(user, pass); } catch (AuthenticationException e) {\n    if (e.getMessage().contains(\"not permitted to log in\")) alert(\"Role disabled or missing: \" + user);\n}","preventionTips":["Run `LIST ROLES` to confirm role exists and has LOGIN before distributing credentials","Avoid disabling LOGIN on roles still used by services","When integrating external auth, ensure the mapped role exists in Cassandra","Keep system_auth replicated correctly so role lookups succeed"],"tags":["cassandra","authentication","roles"],"backgroundTag":"authentication-required","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}