{"record":{"id":"3316b6fabb6dfe2a","repo":"apache/cassandra","slug":"you-do-not-have-access-to-this-datacenter-s","errorCode":null,"errorMessage":"You do not have access to this datacenter (%s)","messagePattern":"You do not have access to this datacenter \\((.+?)\\)","errorType":"exception","errorClass":"UnauthorizedException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/service/ClientState.java","lineNumber":608,"sourceCode":"        {\n            // allow users with sufficient privileges to alter replication params of replicated system keyspaces\n            if (perm == Permission.ALTER && resource.isKeyspaceLevel())\n                return;\n\n            // prevent all other modifications of replicated system keyspaces\n            throw new UnauthorizedException(String.format(\"Cannot %s %s\", perm, resource));\n        }\n    }\n\n    public void validateLogin()\n    {\n        if (user == null)\n        {\n            throw new UnauthorizedException(\"You have not logged in\");\n        }\n        else if (!user.hasLocalAccess())\n        {\n            throw new UnauthorizedException(String.format(\"You do not have access to this datacenter (%s)\", Datacenters.thisDatacenter()));\n        }\n        else\n        {\n            if (remoteAddress != null && !user.hasAccessFromIp(remoteAddress))\n                throw new UnauthorizedException(\"You do not have access from this IP \" + remoteAddress.getHostString());\n        }\n    }\n\n    public void ensureNotAnonymous()\n    {\n        validateLogin();\n        if (user.isAnonymous())\n            throw new UnauthorizedException(\"You have to be logged in and not anonymous to perform this request\");\n    }\n\n    /**\n     * Checks if this user is an ordinary user (not a super or system user).\n     *","sourceCodeStart":590,"sourceCodeEnd":626,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/service/ClientState.java#L590-L626","documentation":"UnauthorizedException thrown by ClientState.validateLogin() when the authenticated user exists but does not have access to the datacenter the request is being served in. AuthenticatedUser.hasLocalAccess() checks DC-scoped access (e.g. configured dc-specific access control), and clients denied in the local DC are rejected.","triggerScenarios":"A user authenticated successfully but whose roles/credentials do not grant access to Datacenters.thisDatacenter(); connecting to a node in a DC the user is not authorized for, e.g. after cross-DC role restrictions were configured; client redirected or driver discovered a node in a restricted DC.","commonSituations":"Multi-datacenter deployments where roles were provisioned only for one DC but the driver's contact points round-robin into another; after moving/rehoming nodes between DCs; misconfigured DSE/Cassandra DC-aware access policies.","solutions":["Grant the role access to the target datacenter (e.g. via role options / ACCESS TO DATACENTERS where supported) or login as a role scoped to that DC.","Configure the driver's load-balancing policy with localDc set to a DC the user can access.","Check Datacenters.thisDatacenter() on the node to confirm the node's DC matches the intended access grants.","Review authentication/role configuration after any DC rename or topology change."],"exampleFix":"// before (driver points at restricted DC)\n.withLocalDc(\"dc_restricted\")\n// after\n.withLocalDc(\"dc_allowed\").addContactPoint(nodeInDcAllowed);","handlingStrategy":"validation","validationCode":"// Before connecting, confirm the intended DC is one the role may access:\n// nodetool describecluster / system.local: check data_center on the node\nString dc = session.execute(\"SELECT data_center FROM system.local\").one().getString(\"data_center\");\nif (!allowedDatacenters.contains(dc)) throw new IllegalStateException(\"Role not authorized in DC \" + dc);","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Configure driver localDc and contact points to DCs the role is granted.","Audit role DC grants after topology changes or DC renames.","Use DC-aware load balancing that stays within authorized DCs."],"tags":["authentication","datacenter","authorization","multi-dc"],"backgroundTag":"permission-denied","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}