apache/cassandra · error · ConfigurationException

%s can't be used with %s

Error message

%s can't be used with %s

What it means

During applyAuth, Cassandra rejects a configuration where the configured INetworkAuthorizer requires authorization but the authenticator does not require authentication. Network authorization (per-DC access control) needs authenticated subjects, so combining e.g. AllowAllAuthenticator with a real network authorizer fails startup with a ConfigurationException.

Source

Thrown at src/java/org/apache/cassandra/auth/AuthConfig.java:129

        DatabaseDescriptor.setRoleManager(roleManager);

        // authenticator

        IInternodeAuthenticator internodeAuthenticator = authInstantiate(conf.internode_authenticator,
                                                                         IInternodeAuthenticator.class,
                                                                         AllowAllInternodeAuthenticator.class);
        DatabaseDescriptor.setInternodeAuthenticator(internodeAuthenticator);

        // network authorizer

        INetworkAuthorizer networkAuthorizer = authInstantiate(conf.network_authorizer,
                                                               INetworkAuthorizer.class,
                                                               AllowAllNetworkAuthorizer.class);

        if (networkAuthorizer.requireAuthorization() && !authenticator.requireAuthentication())
        {
            throw new ConfigurationException(conf.network_authorizer + " can't be used with " + conf.authenticator.class_name, false);
        }

        DatabaseDescriptor.setNetworkAuthorizer(networkAuthorizer);

        // cidr authorizer

        ICIDRAuthorizer cidrAuthorizer = authInstantiate(conf.cidr_authorizer,
                                                         ICIDRAuthorizer.class,
                                                         AllowAllCIDRAuthorizer.class);

        if (cidrAuthorizer.requireAuthorization() && !authenticator.requireAuthentication())
        {
            throw new ConfigurationException(conf.cidr_authorizer + " can't be used with " + conf.authenticator, false);
        }

        DatabaseDescriptor.setCIDRAuthorizer(cidrAuthorizer);

        // Validate at last to have authenticator, authorizer, role-manager and internode-auth setup

View on GitHub (pinned to 88fd0f6a0e)

Solutions

1. Set authenticator: PasswordAuthenticator (or another authenticating authenticator) in cassandra.yaml.
2. Or set network_authorizer: AllowAllNetworkAuthorizer if authentication is not wanted.
3. Restart the node after making the settings consistent.

Example fix

// before (cassandra.yaml)
authenticator: AllowAllAuthenticator
network_authorizer: CassandraNetworkAuthorizer
// after
authenticator: PasswordAuthenticator
network_authorizer: CassandraNetworkAuthorizer

if (!"AllowAllNetworkAuthorizer".equals(conf.network_authorizer) && "AllowAllAuthenticator".equals(conf.authenticator))
    throw new IllegalArgumentException("network_authorizer requires an authenticating authenticator");

try { node.start(); } catch (ConfigurationException e) { log.fatal("network authorizer config invalid: " + e.getMessage()); }

When it happens

Trigger: Setting network_authorizer to a class whose requireAuthorization() returns true (e.g. CassandraNetworkAuthorizer) while authenticator (conf.authenticator.class_name) is AllowAllAuthenticator or otherwise non-authenticating.

Common situations: Enabling datacenter-level access control without first enabling authentication; partially applied security hardening configs.

Understand the failure class

Background: Conflicting config options: "cannot be used together" — configuration validation errors across open-source libraries — this error's family across 162 libraries.

Related errors

• %s has authorization enabled which requires %s to enable aut
• %s requires %s
• %s does not support %s
• Failed to instantiate %s
• %s requires a non-empty %s parameter

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/5fc6d6eae33dc855. Report an issue: GitHub.