apache/cassandra · error · InvalidRequestException

Can not add identity for non-existent role

Error message

Can not add identity for non-existent role '%s'

What it means

A validation check in AddIdentityStatement.validate: the identity references a role name that does not exist in the configured RoleManager, so the statement is rejected with InvalidRequestException. Identities can only be created for existing roles.

Solutions

  1. Create the role first (CREATE ROLE name ...), then add the identity
  2. Check the spelling/exact case of the role name
  3. Confirm DatabaseDescriptor.getRoleManager() points to the backend that actually holds the role

Example fix

// before
CREATE IDENTITY cert1 FOR 'app_role';  -- role does not exist
// after
CREATE ROLE app_role WITH LOGIN = true;
CREATE IDENTITY cert1 FOR 'app_role';
Defensive patterns

Strategy: validation

Validate before calling

// ensure role exists before creating identity
ResultSet rs = session.execute("SELECT role FROM system_auth.roles WHERE role = ?", roleName);
if (rs.all().isEmpty()) throw new IllegalArgumentException("Role '" + roleName + "' does not exist; create it first");

Try / catch

try { session.execute(createIdentity); } catch (InvalidRequestException e) { if (e.getMessage().contains("non-existent role")) { /* create role then retry */ } else throw e; }

Prevention

When it happens

Trigger: CREATE IDENTITY ... FOR role 'name' where isExistingRole(RoleResource.role(role)) is false — role never created, typo'd role name, or role exists in a different auth backend than the one configured via DatabaseDescriptor.

Common situations: Typo in role name; role was dropped before adding the identity; using CassandraRoles vs a custom RoleManager/alternator-ldap setup where the role lives elsewhere; case-sensitivity issues with quoted identifiers.

Understand the failure class

Background: "Not found" and "does not exist" errors: why "Task not found", "No such folder", and "Can't find" fire when a lookup comes back empty — this error's family across 14 libraries.

Related errors

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/c37bea21fe9e7917. Report an issue: GitHub.

Appendix: source

Thrown at src/java/org/apache/cassandra/cql3/statements/AddIdentityStatement.java:68

    }

    @Override
    public void authorize(ClientState state)
    {
        checkPermission(state, Permission.CREATE, RoleResource.root());

        if (!state.getUser().isSuper() && DatabaseDescriptor.getRoleManager().isSuper(RoleResource.role(role)))
            throw new UnauthorizedException("Only superusers can bind identities to a role with superuser status");
    }

    @Override
    public void validate(ClientState state)
    {
        state.ensureNotAnonymous();

        if (!DatabaseDescriptor.getRoleManager().isExistingRole(RoleResource.role(role)))
        {
            throw new InvalidRequestException(String.format("Can not add identity for non-existent role '%s'", role));
        }

        if (!ifNotExists && DatabaseDescriptor.getRoleManager().isExistingIdentity(identity))
            throw new InvalidRequestException(String.format("%s already exists", identity));
    }

    @Override
    public AuditLogContext getAuditLogContext()
    {
        return new AuditLogContext(AuditLogEntryType.CREATE_IDENTITY);
    }

    @Override
    public ResultMessage execute(ClientState state) throws RequestExecutionException, RequestValidationException
    {
        if(!ifNotExists || !DatabaseDescriptor.getRoleManager().isExistingIdentity(identity))
        {
            DatabaseDescriptor.getRoleManager().addIdentity(identity, role);

View on GitHub (pinned to 88fd0f6a0e)