{"record":{"id":"179eb37b9d15de7b","repo":"apache/cassandra","slug":"cannot-s-s","errorCode":null,"errorMessage":"Cannot %s %s","messagePattern":"Cannot (.+?) (.+?)","errorType":"exception","errorClass":"UnauthorizedException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/service/ClientState.java","lineNumber":596,"sourceCode":"\n    private void preventSystemKSSchemaModification(String keyspace, DataResource resource, Permission perm)\n    {\n        // we only care about DDL statements\n        if (perm != Permission.ALTER && perm != Permission.DROP && perm != Permission.CREATE)\n            return;\n\n        // prevent ALL local system keyspace modification\n        if (SchemaConstants.isLocalSystemKeyspace(keyspace))\n            throw new UnauthorizedException(keyspace + \" keyspace is not user-modifiable.\");\n\n        if (SchemaConstants.isReplicatedSystemKeyspace(keyspace))\n        {\n            // allow users with sufficient privileges to alter replication params of replicated system keyspaces\n            if (perm == Permission.ALTER && resource.isKeyspaceLevel())\n                return;\n\n            // prevent all other modifications of replicated system keyspaces\n            throw new UnauthorizedException(String.format(\"Cannot %s %s\", perm, resource));\n        }\n    }\n\n    public void validateLogin()\n    {\n        if (user == null)\n        {\n            throw new UnauthorizedException(\"You have not logged in\");\n        }\n        else if (!user.hasLocalAccess())\n        {\n            throw new UnauthorizedException(String.format(\"You do not have access to this datacenter (%s)\", Datacenters.thisDatacenter()));\n        }\n        else\n        {\n            if (remoteAddress != null && !user.hasAccessFromIp(remoteAddress))\n                throw new UnauthorizedException(\"You do not have access from this IP \" + remoteAddress.getHostString());\n        }","sourceCodeStart":578,"sourceCodeEnd":614,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/service/ClientState.java#L578-L614","documentation":"Thrown as UnauthorizedException when a DDL operation other than a permitted keyspace-level ALTER targets a replicated system keyspace (system_auth, system_distributed, system_traces). Only ALTER of replication parameters at the keyspace level is allowed; all other operations (CREATE, DROP, table-level changes) are rejected with a 'Cannot <perm> <resource>' message.","triggerScenarios":"Executing CREATE/DROP on a replicated system keyspace, ALTER TABLE on a table inside one (non-keyspace-level resource), or ALTER KEYSPACE without the ALTER permission / at table level, e.g. DROP KEYSPACE system_traces, ALTER TABLE system_auth.roles WITH ... .","commonSituations":"Operators trying to drop system_traces or system_distributed to 'clean up'; attempting to recreate system_auth after auth misconfiguration; adjusting replication of system keyspaces via table-level ALTER; automated tooling applying uniform DDL to every keyspace.","solutions":["If changing replication factors of system_auth/system_distributed/system_traces, use ALTER KEYSPACE <ks> WITH replication = {...} while holding ALTER permission on that keyspace resource.","Do not DROP or CREATE replicated system keyspaces; they are required by Cassandra internals.","Check the permission and resource level: the allowance only applies when perm == ALTER and resource.isKeyspaceLevel().","Grant the required permission: GRANT ALTER ON KEYSPACE system_auth TO role."],"exampleFix":"// before\nDROP KEYSPACE system_traces;\n// after\nALTER KEYSPACE system_traces WITH replication = {'class':'NetworkTopologyStrategy','dc1':3};","handlingStrategy":"validation","validationCode":"import static org.apache.cassandra.db.SchemaConstants.isReplicatedSystemKeyspace;\nif (isReplicatedSystemKeyspace(keyspace) && !(isKeyspaceLevelAlter))\n    throw new IllegalStateException(\"Only keyspace-level ALTER is allowed on \" + keyspace);","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Only ever ALTER KEYSPACE-level replication on system_auth/system_distributed/system_traces.","Grant ALTER explicitly and narrowly for replicated system keyspaces.","Never script DROP/CREATE against system keyspaces."],"tags":["authorization","system-keyspace","ddl","replication"],"backgroundTag":"permission-denied","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}