apache/cassandra · error · ConfigurationException

JAAS login configuration missing for JMX authenticator setup

Error message

JAAS login configuration missing for JMX authenticator setup

What it means

AuthenticationProxy's constructor requires a JAAS login configuration name to initialize JMX authentication. Passing null (i.e. no login module configured) throws a ConfigurationException, because the JMX authenticator cannot be set up without a JAAS entry.

Source

Thrown at src/java/org/apache/cassandra/auth/jmx/AuthenticationProxy.java:74

{
    private static Logger logger = LoggerFactory.getLogger(AuthenticationProxy.class);

    // Identifier of JAAS configuration to be used for subject authentication
    private final String loginConfigName;

    /**
     * Creates an instance of <code>JMXPluggableAuthenticator</code>
     * and initializes it with a {@link LoginContext}.
     *
     * @param loginConfigName name of the specifig JAAS login configuration to
     *                        use when authenticating JMX connections
     * @throws SecurityException if the authentication mechanism cannot be
     *         initialized.
     */
    public AuthenticationProxy(String loginConfigName)
    {
        if (loginConfigName == null)
            throw new ConfigurationException("JAAS login configuration missing for JMX authenticator setup");

        this.loginConfigName = loginConfigName;
    }

    /**
     * Perform authentication of the client opening the {@code}MBeanServerConnection{@code}
     *
     * @param credentials optionally these credentials may be supplied by the JMX user.
     *                    Out of the box, the JDK's {@code}RMIServerImpl{@code} is capable
     *                    of supplying a two element String[], containing username and password.
     *                    If present, these credentials will be made available to configured
     *                    {@code}LoginModule{@code}s via {@code}JMXCallbackHandler{@code}.
     *
     * @return the authenticated subject containing any {@code}Principal{@code}s added by
     *the {@code}LoginModule{@code}s
     *
     * @throws SecurityException if the server cannot authenticate the user
     *         with the provided credentials.

View on GitHub (pinned to 88fd0f6a0e)

Solutions

Create a JAAS config file defining the login module (e.g. CassandraJMXAuthenticator entry).
Start Cassandra with -Djava.security.auth.login.config=/path/to/jaas.conf.
Ensure the property feeding loginConfigName (e.g. cassandra.jmx.authentication.login.config) is set in cassandra.yaml/env.
If JAAS auth is not desired, disable JMX authentication rather than leaving it half-configured.

Example fix

// before (cassandra-env.sh)
# JVM_OPTS="$JVM_OPTS -Djava.security.auth.login.config=/etc/cassandra/jaas.conf"
// after
JVM_OPTS="$JVM_OPTS -Djava.security.auth.login.config=/etc/cassandra/jaas.conf"

Defensive patterns

Strategy: validation

Validate before calling

String loginConfig = System.getProperty("cassandra.jmx.server.login.config");
if (loginConfig == null || System.getProperty("java.security.auth.login.config") == null)
    throw new IllegalStateException("JAAS login config must be set before enabling JMX authentication");

Try / catch

try {
    new AuthenticationProxy(loginConfigName);
} catch (ConfigurationException e) {
    log.error("JMX auth enabled but no JAAS login config provided: {}", e.getMessage());
}

Prevention

Create the JAAS file before enabling JMX authentication.
Set -Djava.security.auth.login.config in cassandra-env.sh.
Smoke-test JMX login after config changes.

When it happens

Trigger: Server startup with JMX authentication enabled but cassandra-env/jvm options or cassandra.yaml providing no JAAS login config name, so new AuthenticationProxy(null) is invoked.

Common situations: Enabling JMX authentication without creating/pointing to a JAAS config file (-Dcassandra.jmx.server... / JAVA_TOOL_OPTIONS missing -Djava.security.auth.login.config); typos in the config property name leaving it unset.

Understand the failure class

Background: "X is required", "must be set", "cannot be empty": the missing-required-config error family, from Vertex AI project/location to WeChat keys — this error's family across 18 libraries.

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/6a2192dc2e317ee1. Report an issue: GitHub.