apache/cassandra · error · ConfigurationException

internode_authenticator.parameters.validator_class_name is…

Error message

internode_authenticator.parameters.validator_class_name is not set

What it means

ConfigurationException from the MutualTlsInternodeAuthenticator constructor/setup: internode_authenticator.parameters is present but the mandatory validator_class_name entry is missing, so no certificate validator can be instantiated for internode mTLS. It is a config-completeness guard raised while wiring the internode authenticator.

Solutions

1. Add validator_class_name under internode_authenticator.parameters pointing to a MutualTlsCertificateValidator implementation
2. Verify the validator class name is fully qualified and present on the classpath
3. Provide the companion options (trusted_peer_identities, node_identity) required by the chosen validator

When it happens

Trigger: Thrown at src/java/org/apache/cassandra/auth/MutualTlsInternodeAuthenticator.java:103 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/0568265211a2516c. Report an issue: GitHub.

Appendix: source

Thrown at src/java/org/apache/cassandra/auth/MutualTlsInternodeAuthenticator.java:103

    private static final String VALIDATOR_CLASS_NAME = "validator_class_name";
    private static final String TRUSTED_PEER_IDENTITIES = "trusted_peer_identities";
    private static final String NODE_IDENTITY = "node_identity";
    private final Logger logger = LoggerFactory.getLogger(this.getClass());
    private final NoSpamLogger noSpamLogger = NoSpamLogger.getLogger(logger, 30L, TimeUnit.SECONDS);
    private final MutualTlsCertificateValidator certificateValidator;
    private final List<String> trustedIdentities;
    @Nonnull
    private final MutualTlsCertificateValidityPeriodValidator certificateValidityPeriodValidator;
    private final DurationSpec.IntMinutesBound certificateValidityWarnThreshold;

    public MutualTlsInternodeAuthenticator(Map<String, String> parameters)
    {
        String certificateValidatorClassName = parameters.get(VALIDATOR_CLASS_NAME);
        if (StringUtils.isEmpty(certificateValidatorClassName))
        {
            String message = "internode_authenticator.parameters.validator_class_name is not set";
            logger.error(message);
            throw new ConfigurationException(message);
        }

        certificateValidator = ParameterizedClass.newInstance(new ParameterizedClass(certificateValidatorClassName),
                                                              Arrays.asList("", AuthConfig.class.getPackage().getName()),
                                                              MutualTlsCertificateValidator.class);
        Config config = DatabaseDescriptor.getRawConfig();

        if (parameters.containsKey(TRUSTED_PEER_IDENTITIES))
        {
            // If trusted_peer_identities identities is configured in cassandra.yaml trust only those identities
            trustedIdentities = Arrays.stream(parameters.get(TRUSTED_PEER_IDENTITIES).split(","))
                                      .collect(Collectors.toList());
        }
        else
        {
            // Otherwise, trust the identities extracted from outbound keystore which is the identity that the node uses
            // for making outbound connections.
            trustedIdentities = getIdentitiesFromKeyStore(config.server_encryption_options.outbound_keystore,

View on GitHub (pinned to 88fd0f6a0e)