apache/cassandra · error · SecurityException

Authentication error

Error message

Authentication error

What it means

AuthenticationProxy.authenticate() performs a JAAS login for a JMX client. If the LoginContext throws a LoginException (bad username/password, unknown principal, login module failure), it is wrapped in a SecurityException with message 'Authentication error' and the original exception as the cause.

Source

Thrown at src/java/org/apache/cassandra/auth/jmx/AuthenticationProxy.java:118

        try
        {
            LoginContext loginContext = new LoginContext(loginConfigName, callbackHandler);
            loginContext.login();
            final Subject subject = loginContext.getSubject();
            if (!subject.isReadOnly())
            {
                AccessController.doPrivileged((PrivilegedAction<Void>) () -> {
                    subject.setReadOnly();
                    return null;
                });
            }

            return subject;
        }
        catch (LoginException e)
        {
            logger.trace("Authentication exception", e);
            throw new SecurityException("Authentication error", e);
        }
    }

    /**
     * This callback handler supplies the username and password (which was
     * optionally supplied by the JMX user) to the JAAS login module performing
     * the authentication, should it require them . No interactive user
     * prompting is necessary because the credentials are already available to
     * this class (via its enclosing class).
     */
    private static final class JMXCallbackHandler implements CallbackHandler
    {
        private char[] username;
        private char[] password;
        private JMXCallbackHandler(Object credentials)
        {
            // if username/password credentials were supplied, store them in
            // the relevant variables to make them accessible to LoginModules

View on GitHub (pinned to 88fd0f6a0e)

Solutions

1. Check the cause LoginException in the stack trace / debug log for the real reason.
2. Verify the JMX username exists and the password is correct in the credential store.
3. Confirm the JAAS login module's backend (file, DB) is reachable and readable by the Cassandra process.
4. Reconnect with correct credentials via jconsole/jmxterm.

Example fix

// before
Map<String, String[]> env = new HashMap<>();
env.put(JMXConnector.CREDENTIALS, new String[]{"admin", "wrongpass"});
// after (correct credentials)
env.put(JMXConnector.CREDENTIALS, new String[]{"admin", "correct-password"});

try (JMXConnector conn = JMXConnectorFactory.connect(url, env)) {
    // authenticated
} catch (SecurityException e) {
    Throwable cause = e.getCause();
    if (cause instanceof LoginException) {
        // bad credentials or user store unavailable; log cause and re-prompt
    }
}

When it happens

Trigger: A JMX client connects with wrong credentials, or the JAAS login module fails (user not found, backend user store unreachable), causing LoginContext.login() to throw LoginException.

Common situations: Typos in JMX username/password in jconsole/jmxterm; users not provisioned in the JAAS-backed user store; password file/role backend down so the login module cannot verify credentials.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• JAAS login configuration missing for JMX authenticator setup
• Unrecognized Callback:
• Login config name %s specified for JMX auth, but no configur
• %s is not a valid JMX resource name
• Configure either jmx_server_options in cassandra.yaml and co

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/6b00cc462e95e2bd. Report an issue: GitHub.