{"record":{"id":"1803409ae6667430","repo":"apache/cassandra","slug":"unable-to-perform-authorization-of-login-permissio","errorCode":null,"errorMessage":"Unable to perform authorization of login permission: ","messagePattern":"Unable to perform authorization of login permission: ","errorType":"exception","errorClass":"UnauthorizedException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/auth/CassandraRoleManager.java","lineNumber":504,"sourceCode":"            return getRole(role.getRoleName()).isSuper;\n        }\n        catch (RequestExecutionException e)\n        {\n            logger.debug(\"Failed to authorize {} for super-user permission\", role.getRoleName());\n            throw new UnauthorizedException(\"Unable to perform authorization of super-user permission: \" + e.getMessage(), e);\n        }\n    }\n\n    public boolean canLogin(RoleResource role)\n    {\n        try\n        {\n            return getRole(role.getRoleName()).canLogin;\n        }\n        catch (RequestExecutionException e)\n        {\n            logger.debug(\"Failed to authorize {} for login permission\", role.getRoleName());\n            throw new UnauthorizedException(\"Unable to perform authorization of login permission: \" + e.getMessage(), e);\n        }\n    }\n\n    public Map<String, String> getCustomOptions(RoleResource role)\n    {\n        return Collections.emptyMap();\n    }\n\n    public boolean isExistingRole(RoleResource role)\n    {\n        return !Roles.isNullRole(getRole(role.getRoleName()));\n    }\n\n    public Set<? extends IResource> protectedResources()\n    {\n        return Set.of(DataResource.table(SchemaConstants.AUTH_KEYSPACE_NAME, AuthKeyspace.ROLES),\n                      DataResource.table(SchemaConstants.AUTH_KEYSPACE_NAME, AuthKeyspace.ROLE_MEMBERS));\n    }","sourceCodeStart":486,"sourceCodeEnd":522,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/auth/CassandraRoleManager.java#L486-L522","documentation":"UnauthorizedException from canLogin(): determining whether the role may log in failed because the read of the role row from system_auth.roles threw a RequestExecutionException. As with isSuper, this indicates the auth tables could not be read at QUORUM — it does not mean login is denied.","triggerScenarios":"Thrown at src/java/org/apache/cassandra/auth/CassandraRoleManager.java:504 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Bring enough system_auth replicas back online for QUORUM reads and retry","Increase system_auth replication factor in each datacenter","Check the chained exception for the underlying read failure"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}