apache/cassandra · error · InvalidRequestException

identity ' ' doesn't exist

Error message

identity '%s' doesn't exist

What it means

DropIdentityStatement.validate verifies the identity exists via DatabaseDescriptor.getRoleManager().isExistingIdentity(identity) and throws InvalidRequestException when it does not, unless IF EXISTS was specified. Anonymous callers are rejected earlier by ensureNotAnonymous to avoid existence probing.

Solutions

1. Use DROP IDENTITY IF EXISTS '<identity>' for idempotent cleanup.
2. List existing identities first (e.g., via system_auth/identity queries or role-manager tooling) and match the exact string.
3. Normalize the identity string (Distinguished Name formatting, whitespace, case) before issuing the drop.

Example fix

// before
DROP IDENTITY 'CN=svc, OU=sec';
// after
DROP IDENTITY IF EXISTS 'CN=svc, OU=sec';

// make idempotent at the CQL level
const stmt = `DROP IDENTITY IF EXISTS '${identity}'`;

try { session.execute(cql); } catch (InvalidRequestException e) { if (e.getMessage().contains("doesn't exist")) { /* treat as success for idempotent cleanup */ } else throw e; }

When it happens

Trigger: Executing DROP IDENTITY '<value>' where no identity with that exact value is registered in the role manager and IF EXISTS is absent.

Common situations: Certificate/identity rotation scripts referencing an identity already dropped or never provisioned; case/format mismatches (e.g., DN string differing in spacing or case); re-running cleanup against a fresh cluster.

Understand the failure class

Background: 'Could not be found', 'does not exist', 'not found in database': the resource-not-found family when an ID, slug, key, or URI lookup comes back empty — this error's family across 20 libraries.

Related errors

• Aggregate ' ' doesn't exist
• Function ' ' doesn't exist
• Keyspace doesn't exist
• Keyspace ' ' doesn't exist
• Keyspace ' ' doesn't exist

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/404f12f7ce3e0854. Report an issue: GitHub.

Appendix: source

Thrown at src/java/org/apache/cassandra/cql3/statements/DropIdentityStatement.java:82

            if (!state.getUser().isSuper())
            {
                // If the current user is a regular user and the target role is an admin role
                // we disallow the operation. Only a superuser can remove an identity bound to
                // a role with superuser status
                if (Roles.hasSuperuserStatus(RoleResource.role(roleForIdentity)))
                    throw new UnauthorizedException("Only superusers can remove identity bindings from a role with superuser status");
            }
        }
    }

    @Override
    public void validate(ClientState state)
    {
        state.ensureNotAnonymous();

        if (!ifExists && !DatabaseDescriptor.getRoleManager().isExistingIdentity(identity))
        {
            throw new InvalidRequestException(String.format("identity '%s' doesn't exist", identity));
        }
    }

    @Override
    public AuditLogContext getAuditLogContext()
    {
        return new AuditLogContext(AuditLogEntryType.DROP_IDENTITY);
    }

    @Override
    public ResultMessage execute(ClientState state) throws RequestExecutionException, RequestValidationException
    {
        // not rejected in validate()
        if(!ifExists || DatabaseDescriptor.getRoleManager().isExistingIdentity(identity))
        {
            DatabaseDescriptor.getRoleManager().dropIdentity(identity);
        }
        return null;

View on GitHub (pinned to 88fd0f6a0e)