{"record":{"id":"c7895637b51c9ff9","repo":"apache/cassandra","slug":"you-have-to-be-logged-in-and-not-anonymous-to-perf","errorCode":null,"errorMessage":"You have to be logged in and not anonymous to perform this request","messagePattern":"You have to be logged in and not anonymous to perform this request","errorType":"exception","errorClass":"UnauthorizedException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/service/ClientState.java","lineNumber":621,"sourceCode":"        {\n            throw new UnauthorizedException(\"You have not logged in\");\n        }\n        else if (!user.hasLocalAccess())\n        {\n            throw new UnauthorizedException(String.format(\"You do not have access to this datacenter (%s)\", Datacenters.thisDatacenter()));\n        }\n        else\n        {\n            if (remoteAddress != null && !user.hasAccessFromIp(remoteAddress))\n                throw new UnauthorizedException(\"You do not have access from this IP \" + remoteAddress.getHostString());\n        }\n    }\n\n    public void ensureNotAnonymous()\n    {\n        validateLogin();\n        if (user.isAnonymous())\n            throw new UnauthorizedException(\"You have to be logged in and not anonymous to perform this request\");\n    }\n\n    /**\n     * Checks if this user is an ordinary user (not a super or system user).\n     *\n     * @return {@code true} if this user is an ordinary user, {@code false} otherwise.\n     */\n    public boolean isOrdinaryUser()\n    {\n        return !isSystem() && !isSuper();\n    }\n\n    /**\n     * Checks if this user is a super user.\n     */\n    public boolean isSuper()\n    {\n        if (!DatabaseDescriptor.isAuthenticationRequired())","sourceCodeStart":603,"sourceCodeEnd":639,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/service/ClientState.java#L603-L639","documentation":"UnauthorizedException thrown by ClientState.ensureNotAnonymous() when the request is executed by an anonymous user (e.g. under AllowAllAuthenticator) but the operation requires a concrete non-anonymous identity, such as creating or altering roles, or other operations that must be attributed to a real authenticated user.","triggerScenarios":"Executing statements requiring ensureNotAnonymous() (e.g. CREATE ROLE/USER, requests needing a real identity) while connected via AllowAllAuthenticator or an anonymous login; calling ensureNotAnonymous() from ClientState.validate() paths when user.isAnonymous() is true.","commonSituations":"Clusters switched to PasswordAuthenticator server-side but clients still connecting without credentials resolving to anonymous access; attempting user management on an auth-disabled cluster; tools creating roles during bootstrap on a cluster without real authentication.","solutions":["Enable a real authenticator (e.g. PasswordAuthenticator) in cassandra.yaml and connect with actual credentials.","Log in as a named, non-anonymous role before performing role/user management operations.","Do not attempt CREATE ROLE/USER on a cluster running AllowAllAuthenticator; identity is not meaningful there.","Verify client connection settings so the driver actually authenticates rather than falling back to anonymous access."],"exampleFix":"// before (no credentials, anonymous session)\nsession.execute(\"CREATE ROLE app WITH PASSWORD = 'x' AND LOGIN = true\");\n// after\nCqlSession admin = CqlSession.builder().addContactPoint(addr)\n    .withAuthCredentials(\"cassandra\", \"cassandra\").build();\nadmin.execute(\"CREATE ROLE app WITH PASSWORD = 'x' AND LOGIN = true\");","handlingStrategy":"try-catch","validationCode":"// Verify authentication is enabled and credentials are set before role management:\nif (!authEnabled) throw new IllegalStateException(\"Role management requires PasswordAuthenticator or similar\");","typeGuard":null,"tryCatchPattern":"try {\n    session.execute(\"CREATE ROLE ... \");\n} catch (com.datastax.oss.driver.api.core.servererrors.UnauthorizedException e) {\n    if (e.getMessage().contains(\"not anonymous\")) {\n        session = authenticatedSession(adminCredentials); // reconnect with real credentials\n    } else throw e;\n}","preventionTips":["Run role-management tooling only with authenticated admin sessions.","Do not mix AllowAllAuthenticator clusters with identity-dependent operations.","Assert non-anonymous user in tooling bootstrap before issuing role statements."],"tags":["authentication","anonymous","role-management"],"backgroundTag":"authentication-required","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}