apache/cassandra · error · ConfigurationException

must be positive.

Error message

 must be positive.

What it means

Thrown as a ConfigurationException by CassandraPasswordConfiguration.mustBePositiveException when a numeric password-guardrail configuration parameter is set to a negative value. Several password-complexity thresholds (maxLength, warn/fail thresholds for characteristics, digits, length, etc.) must be positive, and validateParameters rejects any negative value with '<parameter> must be positive.'.

Source

Thrown at src/java/org/apache/cassandra/db/guardrails/CassandraPasswordConfiguration.java:160

        lowerCaseWarn = config.resolveInteger(LOWER_CASE_WARN_KEY, DEFAULT_LOWER_CASE_WARN);
        lowerCaseFail = config.resolveInteger(LOWER_CASE_FAIL_KEY, DEFAULT_LOWER_CASE_FAIL);

        digitsWarn = config.resolveInteger(DIGIT_WARN_KEY, DEFAULT_DIGIT_WARN);
        digitsFail = config.resolveInteger(DIGIT_FAIL_KEY, DEFAULT_DIGIT_FAIL);

        specialsWarn = config.resolveInteger(SPECIAL_WARN_KEY, DEFAULT_SPECIAL_WARN);
        specialsFail = config.resolveInteger(SPECIAL_FAIL_KEY, DEFAULT_SPECIAL_FAIL);

        illegalSequenceLength = config.resolveInteger(ILLEGAL_SEQUENCE_LENGTH_KEY, DEFAULT_ILLEGAL_SEQUENCE_LENGTH);
        dictionary = config.resolveString(DICTIONARY_KEY);
        detailedMessages = config.resolveBoolean(DETAILED_MESSAGES_KEY, true);

        validateParameters();
    }

    ConfigurationException mustBePositiveException(String parameter)
    {
        throw new ConfigurationException(parameter + " must be positive.");
    }

    public void validateParameters() throws ConfigurationException
    {
        if (maxLength < 0) throw mustBePositiveException(MAX_LENGTH_KEY);
        if (characteristicsWarn < 0) throw mustBePositiveException(CHARACTERISTIC_WARN_KEY);
        if (characteristicsFail < 0) throw mustBePositiveException(CHARACTERISTIC_FAIL_KEY);
        if (lowerCaseWarn < 0) throw mustBePositiveException(LOWER_CASE_WARN_KEY);
        if (lowerCaseFail < 0) throw mustBePositiveException(LOWER_CASE_FAIL_KEY);
        if (upperCaseWarn < 0) throw mustBePositiveException(UPPER_CASE_WARN_KEY);
        if (upperCaseFail < 0) throw mustBePositiveException(UPPER_CASE_FAIL_KEY);
        if (specialsWarn < 0) throw mustBePositiveException(SPECIAL_WARN_KEY);
        if (specialsFail < 0) throw mustBePositiveException(SPECIAL_FAIL_KEY);
        if (digitsWarn < 0) throw mustBePositiveException(DIGIT_WARN_KEY);
        if (digitsFail < 0) throw mustBePositiveException(DIGIT_FAIL_KEY);
        if (lengthWarn < 0) throw mustBePositiveException(LENGTH_WARN_KEY);
        if (lengthFail < 0) throw mustBePositiveException(LENGTH_FAIL_KEY);

View on GitHub (pinned to 88fd0f6a0e)

Solutions

1. Set the offending cassandra.yaml password-guardrail parameter to a positive integer
2. Remove the parameter to fall back to defaults instead of using a negative sentinel value
3. Restart/reload configuration and check the log line naming the exact offending key

Example fix

// before
cassandra:
  password_guardrails:
    max_length: -1
// after
cassandra:
  password_guardrails:
    max_length: 128

List<String> keys = List.of("max_length","characteristics_warn","characteristics_fail","digits_warn","digits_fail","length_warn","length_fail");
for (String k : keys)
    if (config.getInt("password_guardrails." + k) < 0)
        throw new ConfigurationException(k + " must be positive.");

try { validateGuardrailConfig(cfg); }
catch (ConfigurationException e) {
    logger.error("Bad password guardrail config: {}", e.getMessage());
    throw e; // fail fast at startup
}

When it happens

Trigger: Configuring cassandra.yaml password guardrails (or constructing CassandraPasswordConfiguration) with a negative value for any of MAX_LENGTH_KEY, CHARACTERISTIC_WARN_KEY, DIGIT_WARN/FAIL_KEY, LENGTH_WARN/FAIL_KEY, etc.

Common situations: Typos in cassandra.yaml (e.g. a stray minus sign); confusing '0 means disabled' semantics from other tools and entering -1 to disable; programmatic config generation producing negative defaults.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• Illegal sequence length can not be lower than %s.
• The shortest password to pass the warning validator for any
• Invalid guardrails configuration:
• default_keyspace_rf to be set (%d) cannot be less than minim
• default_keyspace_rf to be set (%d) cannot be greater than ma

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/f08e6c745257425f. Report an issue: GitHub.