{"record":{"id":"c4df8c871dbf55f7","repo":"apache/cassandra","slug":"keyspace-keyspace-is-not-user-modifiable","errorCode":null,"errorMessage":"${keyspace} keyspace is not user-modifiable.","messagePattern":"(.+?) keyspace is not user-modifiable\\.","errorType":"exception","errorClass":"UnauthorizedException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/service/ClientState.java","lineNumber":587,"sourceCode":"        for (IResource r : resources)\n            if (authorize(r).contains(perm))\n                return;\n\n        throw new UnauthorizedException(String.format(\"User %s has no %s permission on %s or any of its parents\",\n                                                      user.getName(),\n                                                      perm,\n                                                      resource));\n    }\n\n    private void preventSystemKSSchemaModification(String keyspace, DataResource resource, Permission perm)\n    {\n        // we only care about DDL statements\n        if (perm != Permission.ALTER && perm != Permission.DROP && perm != Permission.CREATE)\n            return;\n\n        // prevent ALL local system keyspace modification\n        if (SchemaConstants.isLocalSystemKeyspace(keyspace))\n            throw new UnauthorizedException(keyspace + \" keyspace is not user-modifiable.\");\n\n        if (SchemaConstants.isReplicatedSystemKeyspace(keyspace))\n        {\n            // allow users with sufficient privileges to alter replication params of replicated system keyspaces\n            if (perm == Permission.ALTER && resource.isKeyspaceLevel())\n                return;\n\n            // prevent all other modifications of replicated system keyspaces\n            throw new UnauthorizedException(String.format(\"Cannot %s %s\", perm, resource));\n        }\n    }\n\n    public void validateLogin()\n    {\n        if (user == null)\n        {\n            throw new UnauthorizedException(\"You have not logged in\");\n        }","sourceCodeStart":569,"sourceCodeEnd":605,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/service/ClientState.java#L569-L605","documentation":"Cassandra throws this UnauthorizedException when a client attempts DDL (ALTER, DROP, or CREATE) against a local system keyspace (e.g. system, system_schema, system_auth). Local system keyspaces are fully managed internally and their schema must never be modified by users, so ClientState blocks the operation before permission checks proceed.","triggerScenarios":"Executing CREATE/ALTER/DROP statements (or calling ClientState.ensurePermission for DDL permissions) where the target keyspace is one returned by SchemaConstants.isLocalSystemKeyspace, e.g. ALTER TABLE system.local ..., DROP KEYSPACE system_auth, or CREATE TABLE in system_schema.","commonSituations":"Running migration scripts or ORM auto-schema tools that blindly iterate over all keyspaces including system ones; copying application schema DDL against a cluster with system keyspaces present; attempting to 'clean up' system keyspaces manually; tools that snapshot/restore by re-creating all keyspaces.","solutions":["Exclude all local system keyspaces (SchemaConstants.listLocalSystemKeyspaces / Schema.SYSTEM_KEYSPACE_NAMES) from your DDL scripts and migration tooling.","If you meant to modify application data, target your own keyspace instead of a system one.","If you need to change replication of replicated system keyspaces (system_auth, system_distributed, system_traces), use ALTER KEYSPACE with ALTER permission on a keyspace-level resource — those are handled separately.","To change internals, adjust cassandra.yaml or use nodetool/JMX instead of CQL DDL on system keyspaces."],"exampleFix":"// before\nALTER TABLE system.local ADD extra text;\n// after\nALTER TABLE my_app.settings ADD extra text;","handlingStrategy":"validation","validationCode":"import org.apache.cassandra.db.SchemaConstants;\nif (SchemaConstants.isLocalSystemKeyspace(keyspace))\n    throw new IllegalStateException(\"Refusing DDL on local system keyspace \" + keyspace);","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Filter out system keyspaces in any tool that enumerates keyspaces before issuing DDL.","Maintain an explicit allowlist of application keyspaces in migrations.","Restrict DDL permissions on system keyspaces at the role level."],"tags":["authorization","system-keyspace","ddl","cql"],"backgroundTag":"permission-denied","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}