apache/cassandra · warning

Permissions for JMX resource contains invalid ObjectName

Error message

Permissions for JMX resource contains invalid ObjectName {}

What it means

When authorizing a JMX operation via wildcard patterns, AuthorizationProxy.checkPattern builds an ObjectName from each permission resource's stored objectName string. If that string is malformed, ObjectName construction throws MalformedObjectNameException; Cassandra logs this warning, skips the resource, and denies (or continues checking other resources) rather than crashing.

Solutions

1. Fix the stored resource string: DROP/revoke the bad permission and re-grant with a valid ObjectName (validate with jconsole or `new ObjectName(str)`).
2. List the role's permissions (LIST ALL PERMISSIONS OF <role>) to find the offending JMX resource.
3. Quote special characters in ObjectName key values properly, e.g. org.apache.cassandra:type=ThreadPools,path=\* quoting rules per javax.management.ObjectName docs.
4. Restrict provisioning tooling to validated ObjectName patterns.

Example fix

// before (CQL)
GRANT EXECUTE ON JMX 'org.apache.cassandra:type=*' TO operator; // invalid quoting in some variants
// after
GRANT EXECUTE ON JMX 'org.apache.cassandra:*)' -- no; use valid syntax:
GRANT EXECUTE ON JMX 'org.apache.cassandra:*' TO operator;

// Validate an ObjectName string before granting (Java)
try { javax.management.ObjectName.getInstance(resourceString); }
catch (MalformedObjectNameException e) { throw new IllegalArgumentException("invalid JMX resource: " + resourceString); }

When it happens

Trigger: A JMX permission resource in the role manager (e.g. granted via GRANT PERMISSIONS ON JMX property-like ObjectName string) contains an ObjectName string that fails ObjectName.getInstance — bad quoting, missing domain, invalid characters in key values.

Common situations: Hand-written GRANT statements like GRANT EXECUTE ON JMX 'org.apache.cassandra:type=ThreadPools,path===' that contain invalid key/value syntax; unquoted wildcard or colon characters; editing permissions directly in system_auth; copying ObjectName patterns from logs with truncation.

Related errors

• Access denied
• Access Denied
• Granting permissions on system keyspaces is strictly…
• Invalid keyspace or table name
• Invalid ObjectName? Please report this as a bug.

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/07a7714edb911a2b. Report an issue: GitHub.

Appendix: source

Thrown at src/java/org/apache/cassandra/auth/jmx/AuthorizationProxy.java:399

        // Iterate over the resources the permission has been granted on. Some of these may
        // be patterns, so query the server to retrieve the full list of matching names and
        // remove those from the target set. Once the target set is empty (i.e. all required
        // matches have been satisfied), the requirement is met.
        // If there are still unsatisfied targets after all the JMXResources have been processed,
        // there are insufficient grants to permit the operation.
        for (JMXResource resource : permittedResources)
        {
            try
            {
                Set<ObjectName> matchingNames = queryNames.apply(ObjectName.getInstance(resource.getObjectName()));
                targetNames.removeAll(matchingNames);
                if (targetNames.isEmpty())
                    return true;
            }
            catch (MalformedObjectNameException e)
            {
                logger.warn("Permissions for JMX resource contains invalid ObjectName {}", resource.getObjectName());
            }
        }

        logger.trace("Subject does not have sufficient permissions on all MBeans matching the target pattern {}", target);
        return false;
    }

    /**
     * Given a set of JMXResources upon which the Subject has been granted a particular permission,
     * check whether any match the ObjectName representing the target of the method invocation.
     * At this point, we are sure that whatever the required permission, the Subject has definitely
     * been granted it against this set of JMXResources. The job of this method is only to verify
     * that the target of the invocation is matched by a member of the set.
     *
     * @param target
     * @param permittedResources
     * @return true if at least one of the permitted resources matches the target; false otherwise
     */

View on GitHub (pinned to 88fd0f6a0e)