apache/cassandra · error · AuthenticationException

Provided username %s and/or password are incorrect

Error message

Provided username %s and/or password are incorrect

What it means

Thrown as an AuthenticationException when PasswordAuthenticator.authenticate(username, password) looks up the user and finds NO_SUCH_CREDENTIAL — the username does not exist in system_auth.roles. The cached (sentinel) entry is expunged and the generic incorrect-username-or-password message is raised to avoid leaking which factor was wrong.

Source

Thrown at src/java/org/apache/cassandra/auth/PasswordAuthenticator.java:196

        // intentional use of object equality
        if (hash == NO_SUCH_CREDENTIAL)
        {
            // The cache was unable to load credentials via queryHashedPassword, probably because the supplied
            // rolename doesn't exist. If caching is enabled we will have now cached the sentinel value for that key
            // so we should invalidate it otherwise the cache will continue to serve that until it expires which
            // will be a problem if the role is added in the meantime.
            //
            // We can't just throw the AuthenticationException directly from queryHashedPassword for a similar reason:
            // if an existing role is dropped and active updates are enabled for the cache, the refresh in
            // CacheRefresher::run will log and swallow the exception and keep serving the stale credentials until they
            // eventually expire.
            //
            // So whenever we encounter the sentinal value, here and also in CacheRefresher (if active updates are
            // enabled), we manually expunge the key from the cache. If caching is not enabled, AuthCache::invalidate
            // is a safe no-op.
            cache.invalidateCredentials(username);
            throw new AuthenticationException(String.format("Provided username %s and/or password are incorrect", username));
        }

        if (!checkpw(password, hash))
            throw new AuthenticationException(String.format("Provided username %s and/or password are incorrect", username));

        return new AuthenticatedUser(username, AuthenticationMode.PASSWORD);
    }

    private String queryHashedPassword(String username)
    {
        try
        {
            QueryOptions options = QueryOptions.forInternalCalls(consistencyForRoleRead(username),
                    Lists.newArrayList(ByteBufferUtil.bytes(username)));

            ResultMessage.Rows rows = select(authenticateStatement, options);

            // If either a non-existent role name was supplied, or no credentials

View on GitHub (pinned to 88fd0f6a0e)

Solutions

1. Verify the role exists: SELECT role, can_login FROM system_auth.roles;
2. Create the role if missing: CREATE ROLE <user> WITH LOGIN = true AND PASSWORD = '<pw>';
3. Check system_auth replication/consistency if the role exists on other nodes
4. Fix the username in the client's connection configuration

Example fix

// before (client)
user = 'appuser'
// after
CREATE ROLE appuser WITH LOGIN = true AND PASSWORD = 's3cret';

// verify the role exists before attempting login
SELECT role, can_login FROM system_auth.roles WHERE role = 'appuser';

try { session = cluster.connect(); }
catch (AuthenticationException e) {
    if (e.getMessage().contains("Provided username")) { /* create/repair the role or fix username */ }
}

When it happens

Trigger: Login attempt with a username that has no row in system_auth.roles; roles dropped or system_auth not repaired after node loss; wrong keyspace/replication making the roles table unreadable.

Common situations: Typo in username on connection strings; user deleted while applications still use the credentials; new cluster where the default superuser was never altered and the role renamed.

Related errors

• Unable to perform authentication:
• Required key '%s' is missing
• Required key '%s' is missing for provided username %s
• SASL negotiation not complete
• Credential format error: username or password is empty or co

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/0e0e96c5c6c20ae1. Report an issue: GitHub.