apache/cassandra · error · AuthenticationException

Required key '%s' is missing for provided username %s

Error message

Required key '%s' is missing for provided username %s

What it means

Thrown by PasswordAuthenticator.legacyAuthenticate when the credentials map contains a username but is missing the 'password' key. The message includes the username to help identify which login attempt was malformed.

Source

Thrown at src/java/org/apache/cassandra/auth/PasswordAuthenticator.java:266

    public void setup()
    {
        String query = String.format("SELECT %s FROM %s.%s WHERE role = ?",
                                     SALTED_HASH,
                                     SchemaConstants.AUTH_KEYSPACE_NAME,
                                     AuthKeyspace.ROLES);
        authenticateStatement = prepare(query);
    }

    public AuthenticatedUser legacyAuthenticate(Map<String, String> credentials) throws AuthenticationException
    {
        String username = credentials.get(USERNAME_KEY);
        if (username == null)
            throw new AuthenticationException(String.format("Required key '%s' is missing", USERNAME_KEY));

        String password = credentials.get(PASSWORD_KEY);
        if (password == null)
            throw new AuthenticationException(String.format("Required key '%s' is missing for provided username %s", PASSWORD_KEY, username));

        return authenticate(username, password);
    }

    public SaslNegotiator newSaslNegotiator(InetAddress clientAddress)
    {
        return new PlainTextSaslAuthenticator();
    }

    @Override
    public Set<AuthenticationMode> getSupportedAuthenticationModes()
    {
        return AUTHENTICATION_MODES;
    }

    private static SelectStatement prepare(String query)
    {
        return (SelectStatement) QueryProcessor.getStatement(query, ClientState.forInternalCalls());

View on GitHub (pinned to 88fd0f6a0e)

Solutions

1. Include the 'password' key in the credentials map alongside 'username'
2. Check upstream config parsing for dropped empty-string passwords
3. Use the SASL negotiator (newSaslNegotiator) path used by CQL native drivers instead of the legacy map API

Example fix

// before
Map<String,String> creds = Map.of("username", "appuser");
// after
Map<String,String> creds = Map.of("username", "appuser", "password", "s3cret");

// validate credentials map before calling
if (creds.get("password") == null) throw new IllegalArgumentException("password required");
authenticator.legacyAuthenticate(creds);

try { authenticator.legacyAuthenticate(creds); }
catch (AuthenticationException e) { /* report missing 'password' key to caller */ }

When it happens

Trigger: Calling legacyAuthenticate with a map containing 'username' but no 'password' key; client code constructing credentials conditionally and omitting the password when empty.

Common situations: Half-populated credentials map from a config parser that skipped an empty password field; custom tooling invoking the legacy authentication API.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Related errors

• Required key '%s' is missing
• Provided username %s and/or password are incorrect
• Unable to perform authentication:
• SASL negotiation not complete
• Credential format error: username or password is empty or co

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/2a2b9685d77d351c. Report an issue: GitHub.