{"record":{"id":"188c65ffd7e95369","repo":"apache/cassandra","slug":"role-s-doesn-t-exist","errorCode":null,"errorMessage":"Role %s doesn't exist","messagePattern":"Role (.+?) doesn't exist","errorType":"validation","errorClass":"InvalidRequestException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/cql3/statements/PermissionsManagementStatement.java","lineNumber":54,"sourceCode":"{\n    protected final Set<Permission> permissions;\n    protected IResource resource;\n    protected final RoleResource grantee;\n\n    protected PermissionsManagementStatement(Set<Permission> permissions, IResource resource, RoleName grantee)\n    {\n        this.permissions = permissions;\n        this.resource = resource;\n        this.grantee = RoleResource.role(grantee.getName());\n    }\n\n    public void validate(ClientState state) throws RequestValidationException\n    {\n        // validate login here before authorize to avoid leaking user existence to anonymous users.\n        state.ensureNotAnonymous();\n\n        if (!DatabaseDescriptor.getRoleManager().isExistingRole(grantee))\n            throw new InvalidRequestException(String.format(\"Role %s doesn't exist\", grantee.getRoleName()));\n\n        // if a keyspace is omitted when GRANT/REVOKE ON TABLE <table>, we need to correct the resource.\n        // called both here and in authorize(), as in some cases we do not call the latter.\n        resource = maybeCorrectResource(resource, state);\n\n        if (!resource.exists())\n            throw new InvalidRequestException(String.format(\"Resource %s doesn't exist\", resource));\n    }\n\n    public void authorize(ClientState state) throws UnauthorizedException\n    {\n        // if a keyspace is omitted when GRANT/REVOKE ON TABLE <table>, we need to correct the resource.\n        resource = maybeCorrectResource(resource, state);\n\n        // check that the user has AUTHORIZE permission on the resource or its parents, otherwise reject GRANT/REVOKE.\n        state.ensurePermission(Permission.AUTHORIZE, resource);\n\n        // check that the user has [a single permission or all in case of ALL] on the resource or its parents.","sourceCodeStart":36,"sourceCodeEnd":72,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/cql3/statements/PermissionsManagementStatement.java#L36-L72","documentation":"PermissionsManagementStatement.validate() (used by GRANT/REVOKE) verifies the grantee role exists via the configured RoleManager after ensuring the user is not anonymous. If the role name doesn't exist, this InvalidRequestException is thrown including the role name.","triggerScenarios":"GRANT ... TO <role> or REVOKE ... FROM <role> where grantee.getRoleName() is not a role known to the role manager (e.g. IRoleManager.isExistingRole returns false).","commonSituations":"Typo in role name; role was dropped before the GRANT/REVOKE; client connected against the wrong cluster/environment where the role was never created.","solutions":["Verify the role name with LIST ROLES and correct the spelling.","Create the missing role first (CREATE ROLE ...), then re-run the GRANT/REVOKE.","Confirm you are connected to the intended cluster/environment where the role exists."],"exampleFix":"-- before\nGRANT SELECT ON keyspace ks TO alice; -- alice does not exist\n-- after\nCREATE ROLE alice WITH LOGIN = true;\nGRANT SELECT ON KEYSPACE ks TO alice;","handlingStrategy":"validation","validationCode":"// before granting, check role exists\nRow r = session.execute(\"SELECT role FROM system_auth.roles WHERE role = ?\", grantee).one();\nif (r == null) throw new IllegalStateException(\"Role \" + grantee + \" does not exist\");","typeGuard":null,"tryCatchPattern":"try { session.execute(grant); } catch (InvalidRequestException e) { if (e.getMessage().contains(\"doesn't exist\")) { /* create role or fix name */ } else throw e; }","preventionTips":["Run LIST ROLES to confirm names before granting","Manage roles via idempotent CREATE ROLE IF NOT EXISTS","Verify target environment before permission scripts"],"tags":["cql","roles","permissions"],"backgroundTag":"resource-not-found","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}