{"record":{"id":"83ba680d2d1de4b8","repo":"apache/cassandra","slug":"user-s-has-no-s-permission-on-s-or-any-of-its-p","errorCode":null,"errorMessage":"User %s has no %s permission on %s or any of its parents","messagePattern":"User (.+?) has no (.+?) permission on (.+?) or any of its parents","errorType":"exception","errorClass":"UnauthorizedException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/service/ClientState.java","lineNumber":573,"sourceCode":"                                                                              function.argTypes()));\n    }\n\n    private void ensurePermissionOnResourceChain(Permission perm, IResource resource)\n    {\n        ensurePermissionOnResourceChain(perm, Resources.chain(resource));\n    }\n\n    private void ensurePermissionOnResourceChain(Permission perm, List<? extends IResource> resources)\n    {\n        IResource resource = resources.get(0);\n        if (DatabaseDescriptor.getAuthFromRoot())\n            resources = Lists.reverse(resources);\n\n        for (IResource r : resources)\n            if (authorize(r).contains(perm))\n                return;\n\n        throw new UnauthorizedException(String.format(\"User %s has no %s permission on %s or any of its parents\",\n                                                      user.getName(),\n                                                      perm,\n                                                      resource));\n    }\n\n    private void preventSystemKSSchemaModification(String keyspace, DataResource resource, Permission perm)\n    {\n        // we only care about DDL statements\n        if (perm != Permission.ALTER && perm != Permission.DROP && perm != Permission.CREATE)\n            return;\n\n        // prevent ALL local system keyspace modification\n        if (SchemaConstants.isLocalSystemKeyspace(keyspace))\n            throw new UnauthorizedException(keyspace + \" keyspace is not user-modifiable.\");\n\n        if (SchemaConstants.isReplicatedSystemKeyspace(keyspace))\n        {\n            // allow users with sufficient privileges to alter replication params of replicated system keyspaces","sourceCodeStart":555,"sourceCodeEnd":591,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/service/ClientState.java#L555-L591","documentation":"ensurePermissionOnResourceChain walks the resource and its parents (e.g. table -> keyspace -> ALL KEYSPACES) and throws UnauthorizedException if the authenticated user's granted permissions on none of them include the required permission. This is the standard 'you lack a privilege' error returned to CQL clients.","triggerScenarios":"A statement requiring a permission the user was never granted — e.g. a non-superuser running `SELECT` on a table without any SELECT/SELECT-on-keyspace/SELECT-on-all-keyspaces grant, or `CREATE TABLE` in a keyspace without CREATE permission there.","commonSituations":"New application role provisioned without GRANTs; permission revoked during an incident and clients not updated; role assumptions after a rename; connecting as a role with privileges on a different keyspace than the statement targets.","solutions":["Grant the missing permission: `GRANT <PERM> ON <resource> TO <role>` (e.g. GRANT SELECT ON keyspace.table TO app).","Grant at a coarser level if appropriate: `GRANT SELECT ON KEYSPACE ks TO app` or `GRANT SELECT ON ALL KEYSPACES TO app`.","Inspect current grants: `LIST ALL PERMISSIONS OF <role>` and `LIST ROLES OF <role>`, then fill the gap.","Connect with a role that has the needed permission, or have a superuser perform the operation."],"exampleFix":"// before\n-- as role 'reporting'\nSELECT * FROM metrics.samples; -- Unauthorized\n// after (as superuser)\nGRANT SELECT ON KEYSPACE metrics TO reporting;","handlingStrategy":"try-catch","validationCode":"Row perms = session.execute(\"LIST ALL PERMISSIONS OF %s\", role) != null\n    ? null : null; // use: LIST PERMISSIONS output to confirm required perm before issuing statement","typeGuard":null,"tryCatchPattern":"try { session.execute(cql); } catch (UnauthorizedException e) {\n    if (e.getMessage().contains(\"has no \")) {\n        logger.error(\"Missing grant: {}\", e.getMessage());\n        // request GRANT of the named permission on the named resource\n    }\n}","preventionTips":["Provision roles with explicit GRANT statements in IaC/migration scripts","Verify grants with LIST ALL PERMISSIONS OF <role> before deploying","Grant at keyspace level for app roles rather than per-table ad hoc","Re-audit permissions after role renames, revokes, or incident rollbacks"],"tags":["cassandra","authorization","permissions","roles"],"backgroundTag":"permission-denied","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}