apache/cassandra · error · ConfigurationException

Access forbidden

Error message

Access forbidden

What it means

The reflective lookup or invocation of the compressor's create(Map) method raised a SecurityException, meaning a SecurityManager (or similar access control) forbade the reflective access. The provider converts this into the 'Access forbidden' ConfigurationException to surface the access-control failure during configuration.

Source

Thrown at src/java/org/apache/cassandra/io/compress/DefaultCompressionProvider.java:80

    public ICompressor createCompressor(Class<?> compressorClass, Map<String, String> compressionOptions) throws IllegalStateException
    {
        try
        {
            Method method = compressorClass.getMethod("create", Map.class);
            ICompressor compressor = (ICompressor)method.invoke(null, compressionOptions);
            // Check for unknown options
            for (String provided : compressionOptions.keySet())
                if (!compressor.supportedOptions().contains(provided))
                    throw new ConfigurationException("Unknown compression options " + provided);
            return compressor;
        }
        catch (NoSuchMethodException e)
        {
            throw new ConfigurationException("create method not found", e);
        }
        catch (SecurityException e)
        {
            throw new ConfigurationException("Access forbidden", e);
        }
        catch (IllegalAccessException e)
        {
            throw new ConfigurationException("Cannot access method create in " + compressorClass.getName(), e);
        }
        catch (InvocationTargetException e)
        {
            if (e.getTargetException() instanceof ConfigurationException)
                throw (ConfigurationException) e.getTargetException();

            Throwable cause = e.getCause() == null
                            ? e
                            : e.getCause();

            throw new ConfigurationException(format("%s.create() threw an error: %s %s",
                                                    compressorClass.getSimpleName(),
                                                    cause.getClass().getName(),
                                                    cause.getMessage()),

View on GitHub (pinned to 88fd0f6a0e)

Solutions

1. Grant the necessary ReflectPermission / access in the JVM security policy, or disable the SecurityManager if it is not required.
2. For Java 9+ modules, add --add-opens for the package containing the compressor class.
3. Move the custom compressor into an accessible package or make its create method public in an exported module.
4. Use the built-in compressors, which are always accessible to DefaultCompressionProvider.

Example fix

// before
java ... -Djava.security.manager -Djava.security.policy=strict.policy
// after
java ... --add-opens org.example.compress/org.example.compress=ALL-UNNAMED -Djava.security.policy=strict.policy

try {
    Method m = compressorClass.getMethod("create", Map.class);
    m.trySetAccessible(); // or m.setAccessible(true)
    m.invoke(null, Collections.emptyMap());
} catch (SecurityException | IllegalAccessException e) {
    throw new IllegalStateException("Reflective access to " + compressorClass + ".create denied by security policy", e);
}

try {
    registry.getCompressor(cls, opts);
} catch (ConfigurationException e) {
    if (e.getMessage().equals("Access forbidden")) log.error("SecurityManager/JPMS denies reflective create on {}", cls);
    throw e;
}

When it happens

Trigger: createCompressor() invoked under a Java SecurityManager or restrictive policy that denies reflective access (ReflectPermission) or access to the compressor class/package — typically a custom compressor in a package not opened to the caller.

Common situations: Hardened production JVMs running with a security policy; Java 9+ module systems where the compressor package is not opened/exported; containers with custom java.security policies; third-party compressor classes loaded from restricted classloaders.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• create method not found
• Cannot access method create in %s
• %s.create() threw an error: %s %s
• Unable to create an instance of the compression service prov
• Could not interpret arguments to check vulnerable MBean invo

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/80e3e8618ae82549. Report an issue: GitHub.