{"record":{"id":"e7c86276b5ece314","repo":"apache/cassandra","slug":"cannot-drop-primary-role-for-current-login","errorCode":null,"errorMessage":"Cannot DROP primary role for current login","messagePattern":"Cannot DROP primary role for current login","errorType":"validation","errorClass":"InvalidRequestException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/cql3/statements/DropRoleStatement.java","lineNumber":71,"sourceCode":"        // We only check superuser status for existing roles to avoid\n        // caching info about roles which don't exist (CASSANDRA-9189)\n        if (DatabaseDescriptor.getRoleManager().isExistingRole(role)\n            && Roles.hasSuperuserStatus(role)\n            && !state.getUser().isSuper())\n            throw new UnauthorizedException(\"Only superusers can drop a role with superuser status\");\n    }\n\n    public void validate(ClientState state) throws RequestValidationException\n    {\n        // validate login here before authorize to avoid leaking user existence to anonymous users.\n        state.ensureNotAnonymous();\n\n        if (!ifExists && !DatabaseDescriptor.getRoleManager().isExistingRole(role))\n            throw new InvalidRequestException(String.format(\"%s doesn't exist\", role.getRoleName()));\n\n        AuthenticatedUser user = state.getUser();\n        if (user != null && user.getName().equals(role.getRoleName()))\n            throw new InvalidRequestException(\"Cannot DROP primary role for current login\");\n    }\n\n    public ResultMessage execute(ClientState state) throws RequestValidationException, RequestExecutionException\n    {\n        // not rejected in validate()\n        if (ifExists && !DatabaseDescriptor.getRoleManager().isExistingRole(role))\n            return null;\n\n        // clean up grants and permissions of/on the dropped role.\n        DatabaseDescriptor.getRoleManager().dropRole(state.getUser(), role);\n        DatabaseDescriptor.getAuthorizer().revokeAllFrom(role);\n        DatabaseDescriptor.getAuthorizer().revokeAllOn(role);\n        DatabaseDescriptor.getNetworkAuthorizer().drop(role);\n        DatabaseDescriptor.getCIDRAuthorizer().dropCidrPermissionsForRole(role);\n        return null;\n    }\n    \n    @Override","sourceCodeStart":53,"sourceCodeEnd":89,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/cql3/statements/DropRoleStatement.java#L53-L89","documentation":"Cassandra throws InvalidRequestException to prevent a user from dropping the role that backs their own current login. Dropping your primary role would strand the active session and is rejected unconditionally in validate(), regardless of superuser status.","triggerScenarios":"An authenticated user executes DROP ROLE <their-own-username>, i.e. state.getUser().getName() equals role.getRoleName().","commonSituations":"Scripts iterating roles without excluding the executing identity; an admin accidentally targeting themselves while cleaning up accounts; copy-pasted statements that kept the admin's own role name.","solutions":["Log in as a different role and drop the target role from that session","Pick a different role to drop, or simply demote yourself instead of dropping","In scripts, filter out the current authenticated role before issuing DROP ROLE"],"exampleFix":"// before\n-- logged in as 'svc_admin'\nDROP ROLE svc_admin; // InvalidRequestException\n// after\n-- login as 'bootstrap_super' first\nDROP ROLE svc_admin;","handlingStrategy":"validation","validationCode":"String current = authenticatedUserName; // from session\nif (current.equals(roleToDrop)) throw new IllegalArgumentException(\"refusing to drop own login role\");","typeGuard":null,"tryCatchPattern":"try { session.execute(\"DROP ROLE \" + name); } catch (InvalidRequestException e) { if (e.getMessage().contains(\"Cannot DROP primary role\")) log.error(\"cannot drop the role you are logged in as\"); else throw e; }","preventionTips":["In bulk-drop scripts, always exclude the executing identity","Use a dedicated bootstrap/admin login for role cleanup operations","Review generated DROP statements for self-targeting before execution"],"tags":["cassandra","cql","roles","authentication","self-reference"],"backgroundTag":"invalid-state-transition","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}