apache/cassandra · error · InvalidRequestException

Invalid value for property '%s'. It must be a boolean

Error message

Invalid value for property '%s'. It must be a boolean

What it means

In RoleOptions.validate(), the LOGIN and SUPERUSER options must be Boolean literals. Because CQL parses option values as terms, a quoted or untyped value (e.g. 'true' as a string) arrives as a non-Boolean, and an InvalidRequestException is thrown telling the user the property must be a boolean.

Source

Thrown at src/java/org/apache/cassandra/auth/RoleOptions.java:148

     * during validation of CQL statements, so the IRE results in a error response to the client.
     *
     * @throws InvalidRequestException if any options which are not supported by the configured IRoleManager
     *     are set or if any option value is of an incorrect type.
     */
    public void validate()
    {
        for (Map.Entry<IRoleManager.Option, Object> option : options.entrySet())
        {
            if (!DatabaseDescriptor.getRoleManager().supportedOptions().contains(option.getKey()))
                throw new InvalidRequestException(String.format("%s doesn't support %s",
                                                                DatabaseDescriptor.getRoleManager().getClass().getName(),
                                                                option.getKey()));
            switch (option.getKey())
            {
                case LOGIN:
                case SUPERUSER:
                    if (!(option.getValue() instanceof Boolean))
                        throw new InvalidRequestException(String.format("Invalid value for property '%s'. " +
                                                                        "It must be a boolean",
                                                                        option.getKey()));
                    break;
                case PASSWORD:
                    if (!(option.getValue() instanceof String))
                        throw new InvalidRequestException(String.format("Invalid value for property '%s'. " +
                                                                        "It must be a string",
                                                                        option.getKey()));
                    if (options.containsKey(IRoleManager.Option.HASHED_PASSWORD))
                        throw new InvalidRequestException(String.format("Properties '%s' and '%s' are mutually exclusive",
                                                                        IRoleManager.Option.PASSWORD, IRoleManager.Option.HASHED_PASSWORD));
                    break;
                case HASHED_PASSWORD:
                    if (!(option.getValue() instanceof String))
                        throw new InvalidRequestException(String.format("Invalid value for property '%s'. " +
                                                                        "It must be a string",
                                                                        option.getKey()));
                    if (options.containsKey(IRoleManager.Option.PASSWORD))

View on GitHub (pinned to 88fd0f6a0e)

Solutions

  1. Use unquoted CQL boolean literals: LOGIN = true, SUPERUSER = false.
  2. Fix the client driver/schema so boolean params are sent as boolean terms not strings.
  3. Regenerate templated statements so booleans are not quoted.

Example fix

// before
CREATE ROLE alice WITH LOGIN = 'true';
// after
CREATE ROLE alice WITH LOGIN = true;
Defensive patterns

Strategy: validation

Validate before calling

Object v = roleOptions.get(IRoleManager.Option.LOGIN);
if (v != null && !(v instanceof Boolean))
    throw new IllegalArgumentException("LOGIN must be a boolean literal (true/false), not quoted");

Type guard

boolean isBooleanOption(Object v) { return v instanceof Boolean; }

Try / catch

try {
    session.execute("CREATE ROLE alice WITH LOGIN = ?", true);
} catch (InvalidRequestException e) {
    if (e.getMessage().contains("It must be a boolean")) {
        // resend with unquoted boolean literal
    }
}

Prevention

When it happens

Trigger: CREATE ROLE/ALTER ROLE with LOGIN='true' or SUPERUSER=1 — value parsed as string/integer instead of the boolean literal true/false.

Common situations: Scripts generated from other systems quote boolean values; users migrating from SQL habits write 0/1 or 'true'; templating tools stringify values.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/303e96d35ad70f21. Report an issue: GitHub.