apache/cassandra · error · InvalidRequestException

%s doesn't support %s

Error message

%s doesn't support %s

What it means

RoleOptions.validate() checks each requested role option against the set of options the configured IRoleManager implementation supports. If an option (e.g. PASSWORD, OPTIONS) is not in supportedOptions(), an InvalidRequestException naming the role manager class and the unsupported option is thrown. The statement is rejected before any role is created or altered.

Source

Thrown at src/java/org/apache/cassandra/auth/RoleOptions.java:140

        return Optional.ofNullable((Map<String, String>) options.get(IRoleManager.Option.OPTIONS));
    }

    /**
     * Validate the contents of the options in two ways:
     * - Ensure that only a subset of the options supported by the configured IRoleManager are set
     * - Validate the type of any option values present.
     * Should either condition fail, then InvalidRequestException is thrown. This method is called
     * during validation of CQL statements, so the IRE results in a error response to the client.
     *
     * @throws InvalidRequestException if any options which are not supported by the configured IRoleManager
     *     are set or if any option value is of an incorrect type.
     */
    public void validate()
    {
        for (Map.Entry<IRoleManager.Option, Object> option : options.entrySet())
        {
            if (!DatabaseDescriptor.getRoleManager().supportedOptions().contains(option.getKey()))
                throw new InvalidRequestException(String.format("%s doesn't support %s",
                                                                DatabaseDescriptor.getRoleManager().getClass().getName(),
                                                                option.getKey()));
            switch (option.getKey())
            {
                case LOGIN:
                case SUPERUSER:
                    if (!(option.getValue() instanceof Boolean))
                        throw new InvalidRequestException(String.format("Invalid value for property '%s'. " +
                                                                        "It must be a boolean",
                                                                        option.getKey()));
                    break;
                case PASSWORD:
                    if (!(option.getValue() instanceof String))
                        throw new InvalidRequestException(String.format("Invalid value for property '%s'. " +
                                                                        "It must be a string",
                                                                        option.getKey()));
                    if (options.containsKey(IRoleManager.Option.HASHED_PASSWORD))
                        throw new InvalidRequestException(String.format("Properties '%s' and '%s' are mutually exclusive",

View on GitHub (pinned to 88fd0f6a0e)

Solutions

  1. Remove the unsupported option from the CREATE/ALTER ROLE statement (e.g. drop WITH PASSWORD).
  2. Check DatabaseDescriptor.getRoleManager().supportedOptions() (via nodetool or logs) to see which options are valid.
  3. If external authentication is used, manage credentials in the external system instead of CQL.
  4. If a custom IRoleManager is in use, add the option to its supportedOptions() return set if it is genuinely supported.

Example fix

// before
CREATE ROLE alice WITH PASSWORD = 'secret' AND LOGIN = true;
// after (role manager does not support PASSWORD)
CREATE ROLE alice WITH LOGIN = true;
Defensive patterns

Strategy: validation

Validate before calling

Set<IRoleManager.Option> supported = DatabaseDescriptor.getRoleManager().supportedOptions();
if (!supported.contains(IRoleManager.Option.PASSWORD)) {
    throw new IllegalStateException("Role manager does not support PASSWORD");
}

Try / catch

try {
    roleOptions.validate();
} catch (InvalidRequestException e) {
    log.error("Unsupported role option: {}", e.getMessage());
}

Prevention

When it happens

Trigger: Executing CREATE ROLE or ALTER ROLE with an option (like PASSWORD) while the configured IRoleManager (e.g. CassandraRoleManager with LDAP/external managers, or a custom IRoleManager) does not list that option in its supportedOptions().

Common situations: Switching role managers via role_manager config to an external manager that only supports LOGIN/SUPERUSER/OPTIONS, then running legacy CREATE ROLE ... WITH PASSWORD statements; custom IRoleManager implementations with incomplete supportedOptions().

Related errors

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/1d70f5a9ae15ed43. Report an issue: GitHub.