{"record":{"id":"9707216e1d098152","repo":"apache/cassandra","slug":"unable-to-perform-authentication-e-getmessage","errorCode":null,"errorMessage":"Unable to perform authentication: ${e.getMessage()}","messagePattern":"Unable to perform authentication: (.+?)","errorType":"exception","errorClass":"AuthenticationException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/service/ClientState.java","lineNumber":428,"sourceCode":"    {\n        if (user.isAnonymous() || canLogin(user))\n        {\n            this.user = user;\n            this.superuserStatus = null;\n        }\n        else\n            throw new AuthenticationException(String.format(\"%s is not permitted to log in\", user.getName()));\n    }\n\n    private boolean canLogin(AuthenticatedUser user)\n    {\n        try\n        {\n            return user.canLogin();\n        }\n        catch (RequestExecutionException | RequestValidationException e)\n        {\n            throw new AuthenticationException(\"Unable to perform authentication: \" + e.getMessage(), e);\n        }\n    }\n\n    public void ensureAllKeyspacesPermission(Permission perm)\n    {\n        if (isInternal)\n            return;\n        validateLogin();\n        ensurePermission(perm, DataResource.root());\n    }\n\n    public void ensureKeyspacePermission(String keyspace, Permission perm)\n    {\n        ensurePermission(keyspace, perm, DataResource.keyspace(keyspace));\n    }\n\n    public void ensureAllTablesPermission(String keyspace, Permission perm)\n    {","sourceCodeStart":410,"sourceCodeEnd":446,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/service/ClientState.java#L410-L446","documentation":"canLogin wraps user.canLogin() and converts RequestExecutionException/RequestValidationException (e.g. timeouts or consistency failures reading system_auth during login) into AuthenticationException with the message 'Unable to perform authentication: ...'. It signals that login could not be EVALUATED because the underlying auth lookup failed, as opposed to an explicit denial.","triggerScenarios":"Reading the role's login state from system_auth fails: RequestTimeoutException / UnavailableException due to insufficient replicas (under-replicated system_auth, a node down), or a RequestValidationException from a corrupt/missing auth table.","commonSituations":"system_auth lost replication after a node failure so role queries time out at QUORUM; cluster recovered from backup without system_auth data; heavy GC/overload causing auth read timeouts during login.","solutions":["Repair system_auth: `nodetool repair -pr system_auth` on all nodes; ensure its RF matches cluster topology and all replicas are up.","Bring the failed replicas back online so the QUORUM read of roles succeeds.","Check `nodetool describecluster`/logs for schema disagreement and resolve it (RequestValidationException path).","Retry the login once the auth tables are healthy; escalate persistent timeouts with auth read consistency adjustments."],"exampleFix":"// before\ncqlsh -u admin -p pass # Unable to perform authentication: Operation timed out\n// after\nnodetool repair -pr system_auth   # on every node\ncqlsh -u admin -p pass","handlingStrategy":"retry","validationCode":"// pre-check auth table availability\nResultSet rs = session.execute(\"SELECT role FROM system_auth.roles LIMIT 1\");\nif (rs.wasApplied() == false || rs == null) logger.warn(\"system_auth unavailable; logins will fail\");","typeGuard":null,"tryCatchPattern":"try { client.connect(u, p); } catch (AuthenticationException e) {\n    if (e.getMessage().startsWith(\"Unable to perform authentication\")) {\n        backoffRetry(connect, 3);\n        scheduleSystemAuthRepair();\n    }\n}","preventionTips":["Keep system_auth replication factor adequate and all replicas healthy","Run regular `nodetool repair system_auth`","Monitor auth-read timeouts in server logs","Back up and verify system_auth contents after cluster restores"],"tags":["cassandra","authentication","timeout","system-auth"],"backgroundTag":"authentication-required","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}