apache/cassandra · error · ConfigurationException

creates a role with no password, which cannot authenticate…

Error message

%s creates a role with no password, which %s cannot authenticate (supported modes: %s). Configure an authenticator supporting mutual TLS, such as %s.

What it means

ConfigurationException from validateConfiguration: the role initializer would auto-create a role with no password, but the configured IAuthenticator cannot authenticate password-less roles (only mutual-TLS-capable authenticators can). The message lists the configured authenticator and the supported modes — a cross-component config consistency check at startup.

Solutions

1. Switch the authenticator to one supporting mutual TLS (e.g. MutualTlsAuthenticator) as the message suggests
2. Disable the default role initializer if automatic role creation is not needed
3. Manually create the role with appropriate credentials instead of relying on the initializer

When it happens

Trigger: Thrown at src/java/org/apache/cassandra/auth/MutualTlsDefaultRoleInitializer.java:116 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.
• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/47358c10791813e3. Report an issue: GitHub.

Appendix: source

Thrown at src/java/org/apache/cassandra/auth/MutualTlsDefaultRoleInitializer.java:116

    @Override
    public void validateConfiguration() throws ConfigurationException
    {
        if (Strings.isNullOrEmpty(role))
            throw new ConfigurationException(String.format("%s requires a non-empty '%s' parameter",
                                                           getClass().getSimpleName(), ROLE));

        if (Strings.isNullOrEmpty(identity))
            throw new ConfigurationException(String.format("%s requires a non-empty '%s' parameter",
                                                           getClass().getSimpleName(), IDENTITY));

        // The role this creates has no password, so an authenticator which cannot authenticate by certificate
        // would leave a freshly bootstrapped cluster with no way to log in at all.
        IAuthenticator authenticator = DatabaseDescriptor.getAuthenticator();
        Set<IAuthenticator.AuthenticationMode> modes = authenticator.getSupportedAuthenticationModes();
        if (authenticator.requireAuthentication() && !modes.isEmpty() && !modes.contains(IAuthenticator.AuthenticationMode.MTLS))
        {
            throw new ConfigurationException(String.format("%s creates a role with no password, which %s cannot " +
                                                           "authenticate (supported modes: %s). Configure an " +
                                                           "authenticator supporting mutual TLS, such as %s.",
                                                           getClass().getSimpleName(),
                                                           authenticator.getClass().getSimpleName(),
                                                           modes,
                                                           MutualTlsAuthenticator.class.getSimpleName()));
        }
    }
}

View on GitHub (pinned to 88fd0f6a0e)