{"record":{"id":"637bfef51406d356","repo":"apache/cassandra","slug":"unable-to-perform-authorization-of-permissions-s","errorCode":null,"errorMessage":"Unable to perform authorization of permissions: %s","messagePattern":"Unable to perform authorization of permissions: (.+?)","errorType":"exception","errorClass":"UnauthorizedException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/auth/CassandraAuthorizer.java","lineNumber":111,"sourceCode":"    public Set<Permission> authorize(AuthenticatedUser user, IResource resource)\n    {\n        try\n        {\n            if (user.isSuper())\n                return resource.applicablePermissions();\n\n            Set<Permission> permissions = EnumSet.noneOf(Permission.class);\n\n            // Even though we only care about the RoleResource here, we use getRoleDetails as\n            // it saves a Set creation in RolesCache\n            for (Role role: user.getRoleDetails())\n                addPermissionsForRole(permissions, resource, role.resource);\n            return permissions;\n        }\n        catch (RequestExecutionException | RequestValidationException e)\n        {\n            logger.debug(\"Failed to authorize {} for {}\", user, resource);\n            throw new UnauthorizedException(\"Unable to perform authorization of permissions: \" + e.getMessage(), e);\n        }\n    }\n\n    public Set<Permission> grant(AuthenticatedUser performer, Set<Permission> permissions, IResource resource, RoleResource grantee)\n    throws RequestValidationException, RequestExecutionException\n    {\n        String roleName = escapeCqlLiteral(grantee.getRoleName());\n        String resourceName = escapeCqlLiteral(resource.getName());\n        Set<Permission> existingPermissions = getExistingPermissions(roleName, resourceName, permissions);\n        Set<Permission> nonExistingPermissions = Sets.difference(permissions, existingPermissions);\n\n        if (!nonExistingPermissions.isEmpty())\n        {\n            modifyRolePermissions(nonExistingPermissions, resource, grantee, \"+\");\n            addLookupEntry(resource, grantee);\n        }\n\n        return nonExistingPermissions;","sourceCodeStart":93,"sourceCodeEnd":129,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/auth/CassandraAuthorizer.java#L93-L129","documentation":"Not an authorization denial: authorize() wraps a RequestExecutionException raised while reading role permissions from the system_auth tables (roles/role_permissions). It fires when the auth query itself fails — e.g. insufficient replication, unavailable nodes, or consistency timeouts at authReadConsistencyLevel — leaving Cassandra unable to determine the user's permissions.","triggerScenarios":"Thrown at src/java/org/apache/cassandra/auth/CassandraAuthorizer.java:111 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Check availability of the nodes holding system_auth replicas and retry once the cluster is healthy","Increase replication factor of system_auth so reads at QUORUM/local auth consistency can succeed","Inspect the debug log line 'Failed to authorize ...' for the underlying read failure"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}