apache/cassandra · error · AuthenticationException

Authentication ID must not be null

Error message

Authentication ID must not be null

What it means

decodeCredentials() validates that the second NUL-delimited segment (the authentication ID, i.e. username/role) is present and non-empty. An empty authcid cannot identify a role, so AuthenticationException is thrown.

Source

Thrown at src/java/org/apache/cassandra/auth/PasswordAuthenticator.java:355

            for (int i = bytes.length - 1; i >= 0; i--)
            {
                if (bytes[i] == NUL)
                {
                    if (pass == null)
                        pass = Arrays.copyOfRange(bytes, i + 1, end);
                    else if (user == null)
                        user = Arrays.copyOfRange(bytes, i + 1, end);
                    else
                        throw new AuthenticationException("Credential format error: username or password is empty or contains NUL(\\0) character");

                    end = i;
                }
            }

            if (pass == null || pass.length == 0)
                throw new AuthenticationException("Password must not be null");
            if (user == null || user.length == 0)
                throw new AuthenticationException("Authentication ID must not be null");

            username = new String(user, StandardCharsets.UTF_8);
            password = new String(pass, StandardCharsets.UTF_8);
        }
    }

    public static class CredentialsCache extends AuthCache<String, String> implements CredentialsCacheMBean
    {
        private CredentialsCache(PasswordAuthenticator authenticator)
        {
            super(CACHE_NAME,
                  DatabaseDescriptor::setCredentialsValidity,
                  DatabaseDescriptor::getCredentialsValidity,
                  DatabaseDescriptor::setCredentialsUpdateInterval,
                  DatabaseDescriptor::getCredentialsUpdateInterval,
                  DatabaseDescriptor::setCredentialsCacheMaxEntries,
                  DatabaseDescriptor::getCredentialsCacheMaxEntries,
                  DatabaseDescriptor::setCredentialsCacheActiveUpdate,

View on GitHub (pinned to 88fd0f6a0e)

Solutions

1. Provide a non-empty username (role name) in the SASL PLAIN token as the second NUL-separated segment
2. Set the credentials in the client (cqlsh -u user -p pass, driver AuthProvider, or environment variables used by tooling)
3. Check for string-building bugs that drop the username segment

Example fix

// before
String token = "\0\0" + pass; // empty authcid
// after
String token = "" /*authzid*/ + "\0" + role + "\0" + pass;

if (user == null || user.isEmpty()) throw new IllegalArgumentException("username/role required for SASL PLAIN");

boolean hasAuthcid(String[] segments) { return segments.length >= 2 && segments[1] != null && !segments[1].isEmpty(); }

try { authenticate(user, pass); } catch (AuthenticationException e) { if (e.getMessage().contains("Authentication ID")) fixUsernameConfig(); }

When it happens

Trigger: AuthResponse token shaped like "\0password" or "\0\0password" where the username segment between the first and second NUL is missing or empty.

Common situations: Scripts sending only a password; misconfigured drivers with empty username; users running cqlsh without -u and no default login set.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Password must not be null
• SASL negotiation not complete
• Credential format error: username or password is empty or co
• SASL Authentication is not supported in version 1 of the pro
• Auth check after connection closed

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/14fbd31e84e98521. Report an issue: GitHub.