apache/cassandra · error · AuthenticationException

Password must not be null

Error message

Password must not be null

What it means

After splitting the SASL PLAIN token on NULs, decodeCredentials() verifies that a non-empty password segment was extracted. A missing or zero-length password cannot be used for authentication, so AuthenticationException is thrown instead of attempting a lookup.

Source

Thrown at src/java/org/apache/cassandra/auth/PasswordAuthenticator.java:353

            byte[] pass = null;
            int end = bytes.length;
            for (int i = bytes.length - 1; i >= 0; i--)
            {
                if (bytes[i] == NUL)
                {
                    if (pass == null)
                        pass = Arrays.copyOfRange(bytes, i + 1, end);
                    else if (user == null)
                        user = Arrays.copyOfRange(bytes, i + 1, end);
                    else
                        throw new AuthenticationException("Credential format error: username or password is empty or contains NUL(\\0) character");

                    end = i;
                }
            }

            if (pass == null || pass.length == 0)
                throw new AuthenticationException("Password must not be null");
            if (user == null || user.length == 0)
                throw new AuthenticationException("Authentication ID must not be null");

            username = new String(user, StandardCharsets.UTF_8);
            password = new String(pass, StandardCharsets.UTF_8);
        }
    }

    public static class CredentialsCache extends AuthCache<String, String> implements CredentialsCacheMBean
    {
        private CredentialsCache(PasswordAuthenticator authenticator)
        {
            super(CACHE_NAME,
                  DatabaseDescriptor::setCredentialsValidity,
                  DatabaseDescriptor::getCredentialsValidity,
                  DatabaseDescriptor::setCredentialsUpdateInterval,
                  DatabaseDescriptor::getCredentialsUpdateInterval,
                  DatabaseDescriptor::setCredentialsCacheMaxEntries,

View on GitHub (pinned to 88fd0f6a0e)

Solutions

1. Supply a non-empty password in the SASL PLAIN response (even if the account legitimately uses empty password, set it explicitly)
2. Fix client code so the password variable is populated before building the token
3. Verify cqlsh/driver credentials (e.g. -u/-p flags or credentials provider) are not blank

Example fix

// before
String token = authzid + "\0" + user + "\0" + password; // password == ""
// after
if (password == null || password.isEmpty()) throw new IllegalArgumentException("password required");
String token = authzid + "\0" + user + "\0" + password;

if (password == null || password.isEmpty()) throw new IllegalArgumentException("password required for SASL PLAIN");

boolean hasPassword(Credentials c) { return c != null && c.password != null && !c.password.isEmpty(); }

try { authenticate(user, pass); } catch (AuthenticationException e) { promptForCredentials(); }

When it happens

Trigger: AuthResponse token where the final segment after the second NUL is absent or empty (token ends with a NUL), e.g. client sends only authcid without a password.

Common situations: Drivers or scripts that build the PLAIN message with an unset password variable; users configuring empty passwords; tooling sending truncated credentials.

Related errors

• Authentication ID must not be null
• SASL negotiation not complete
• Credential format error: username or password is empty or co
• SASL Authentication is not supported in version 1 of the pro
• Auth check after connection closed

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/49acb7db8e7a2f06. Report an issue: GitHub.