apache/cassandra · error · InvalidRequestException

Role name can't be an empty string

Error message

Role name can't be an empty string

What it means

CreateRoleStatement.validate rejects CREATE ROLE statements whose role name is the empty string, because role names are used as identifiers in RoleResource and authentication tables and an empty name would be unusable/ambiguous.

Source

Thrown at src/java/org/apache/cassandra/cql3/statements/CreateRoleStatement.java:81

        this.cidrPermissions = cidrPermissions;
        this.ifNotExists = ifNotExists;
    }

    public void authorize(ClientState state) throws UnauthorizedException
    {
        super.checkPermission(state, Permission.CREATE, RoleResource.root());
        if (opts.getSuperuser().isPresent())
        {
            if (opts.getSuperuser().get() && !state.getUser().isSuper())
                throw new UnauthorizedException("Only superusers can create a role with superuser status");
        }
    }

    public void validate(ClientState state) throws RequestValidationException
    {
        opts.validate();
        if (role.getRoleName().isEmpty())
            throw new InvalidRequestException("Role name can't be an empty string");

        if (dcPermissions != null)
        {
            dcPermissions.validate();
        }

        if (cidrPermissions != null)
        {
            cidrPermissions.validate();
        }

        // validate login here before authorize to avoid leaking role existence to anonymous users.
        state.ensureNotAnonymous();

        if (!ifNotExists && role != RoleResource.GENERATED_ROLE && DatabaseDescriptor.getRoleManager().isExistingRole(role))
            throw new InvalidRequestException(String.format("%s already exists", role.getRoleName()));
    }

View on GitHub (pinned to 88fd0f6a0e)

Solutions

1. Supply a non-empty role name in the CREATE ROLE statement.
2. Validate/trim the name in application code before issuing CQL.
3. If names come from config or templates, fail fast when the placeholder resolves to empty.

Example fix

// before
String cql = String.format("CREATE ROLE '%s' WITH LOGIN = true", cfg.getRoleName()); // roleName=""
// after
if (cfg.getRoleName() == null || cfg.getRoleName().trim().isEmpty()) throw new IllegalArgumentException("role name required");
String cql = String.format("CREATE ROLE '%s' WITH LOGIN = true", cfg.getRoleName().trim());

function assertValidRoleName(name) {
  if (typeof name !== 'string' || name.trim().length === 0) throw new Error('role name must be a non-empty string');
}

function isNonEmptyString(v) { return typeof v === 'string' && v.trim().length > 0; }

try { session.execute(cql); } catch (InvalidRequestException e) { if (e.getMessage().contains("Role name can't be an empty string")) { /* fix the templated name input */ } else throw e; }

When it happens

Trigger: Executing CREATE ROLE '' ... — the parsed role name has length 0.

Common situations: Templated provisioning scripts where a role-name variable is unset/empty; application code interpolating user-supplied names without trimming/validating; copy-paste errors leaving the quoted name blank.

Understand the failure class

Background: "must not be empty", "cannot be empty" — required-field validation errors across open-source libraries — this error's family across 41 libraries.

Related errors

• REVOKE operation is not supported by AllowAllAuthorizer
• Multiple definition for property '%s'
• Key may not be empty
• Key may not be empty
• Key length of %d is longer than maximum of %d

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/e6012e02ed456309. Report an issue: GitHub.