{"record":{"id":"8fd6f52afbce2892","repo":"apache/cassandra","slug":"only-superusers-are-allowed-to-alter-access-to-dat","errorCode":null,"errorMessage":"Only superusers are allowed to alter access to datacenters.","messagePattern":"Only superusers are allowed to alter access to datacenters\\.","errorType":"validation","errorClass":"UnauthorizedException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/cql3/statements/AlterRoleStatement.java","lineNumber":110,"sourceCode":"        {\n            checkTrue(ifExists, \"Role %s doesn't exist\", role.getRoleName());\n        }\n    }\n\n    public void authorize(ClientState state) throws UnauthorizedException\n    {\n        AuthenticatedUser user = state.getUser();\n        boolean isSuper = user.isSuper();\n\n        if (opts.getSuperuser().isPresent() && user.getRoles().contains(role))\n            throw new UnauthorizedException(\"You aren't allowed to alter your own superuser \" +\n                                            \"status or that of a role granted to you\");\n\n        if (opts.getSuperuser().isPresent() && !isSuper)\n            throw new UnauthorizedException(\"Only superusers are allowed to alter superuser status\");\n\n        if (dcPermissions != null && !isSuper)\n            throw new UnauthorizedException(\"Only superusers are allowed to alter access to datacenters.\");\n\n        if (cidrPermissions != null && !isSuper)\n            throw new UnauthorizedException(\"Only superusers are allowed to alter access from CIDR groups.\");\n\n        // superusers can do whatever else they like\n        if (isSuper)\n            return;\n\n        // a role may only modify the subset of its own attributes as determined by IRoleManager#alterableOptions\n        if (user.getName().equals(role.getRoleName()))\n        {\n            for (Option option : opts.getOptions().keySet())\n            {\n                if (!DatabaseDescriptor.getRoleManager().alterableOptions().contains(option))\n                    throw new UnauthorizedException(String.format(\"You aren't allowed to alter %s\", option));\n            }\n        }\n        else","sourceCodeStart":92,"sourceCodeEnd":128,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/cql3/statements/AlterRoleStatement.java#L92-L128","documentation":"AlterRoleStatement.authorize rejects changes to datacenter access (DC permissions) by non-superusers. Modifying which datacenters a role can access is a superuser-only operation, enforced after the superuser-option checks in authorize.","triggerScenarios":"ALTER ROLE x WITH ... DC-permission clause (e.g. SET ACCESS TO DATACENTERS) executed when dcPermissions != null and user.isSuper() is false.","commonSituations":"Non-super admins provisioning multi-DC access for app roles; scripts migrated from environments where lesser admins could manage DC grants; mistaken assumption that ALTER permission on a role includes DC permission changes.","solutions":["Execute the DC-permission ALTER as a superuser","Have a superuser perform only the DC ACCESS portion while the non-super user makes other option changes","Grant superuser to the operating role if policy permits"],"exampleFix":"// before (non-super user)\nALTER ROLE app_role WITH SET ACCESS TO ALL DATACENTERS;\n// after: run as superuser, or remove the DC clause\nALTER ROLE app_role WITH LOGIN = true;","handlingStrategy":"validation","validationCode":"// pre-check caller is superuser before DC permission changes\nif (dcPermissionsClause != null && !currentUser.isSuper())\n    throw new IllegalStateException(\"DC permission changes require a superuser account\");","typeGuard":null,"tryCatchPattern":"try { session.execute(alterRoleCql); } catch (UnauthorizedException e) { if (e.getMessage().contains(\"alter access to datacenters\")) { /* rerun with superuser credentials */ } else throw e; }","preventionTips":["Route all DC ACCESS grants through superuser-operated tooling","Keep multi-DC access changes in a superuser-only change process","Check LIST ROLES / superuser status of automation credentials before multi-DC provisioning"],"tags":["auth","security","datacenter"],"backgroundTag":"permission-denied","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}