apache/cassandra · error · ConfigurationException

%s has authorization enabled which requires %s to enable aut

Error message

%s has authorization enabled which requires %s to enable authentication

What it means

During startup configuration (AuthConfig.applyAuth), Cassandra validates that the configured IAuthorizer does not require authorization when the configured IAuthenticator does not require authentication. An authorizer like CassandraAuthorizer needs authenticated identities to grant permissions to, so combining e.g. AllowAllAuthenticator with CassandraAuthorizer is rejected with a ConfigurationException.

Source

Thrown at src/java/org/apache/cassandra/auth/AuthConfig.java:89

        if (!(authenticator instanceof PasswordAuthenticator || authenticator instanceof MutualTlsAuthenticator)
            && (conf.credentials_update_interval != null
                || conf.credentials_validity.toMilliseconds() != 2000
                || conf.credentials_cache_max_entries != 1000))
        {
            logger.info("Configuration options credentials_update_interval, credentials_validity and " +
                        "credentials_cache_max_entries may not be applicable for the configured authenticator ({})",
                        authenticator.getClass().getName());
        }

        DatabaseDescriptor.setAuthenticator(authenticator);

        // authorizer

        IAuthorizer authorizer = authInstantiate(conf.authorizer, IAuthorizer.class, AllowAllAuthorizer.class);

        if (!authenticator.requireAuthentication() && authorizer.requireAuthorization())
        {
            throw new ConfigurationException(authorizer.getClass().getName() + " has authorization enabled which requires " +
                                             authenticator.getClass().getName() + " to enable authentication", false);
        }

        DatabaseDescriptor.setAuthorizer(authorizer);

        // default role initializer: bootstraps the first role on a cluster which has none yet. Instantiated
        // before the role manager because the role manager depends on it (see IRoleManager#defaultRoleInitializer).

        IDefaultRoleInitializer defaultRoleInitializer = authInstantiate(conf.default_role_initializer,
                                                                         IDefaultRoleInitializer.class,
                                                                         PasswordDefaultRoleInitializer.instance);
        DatabaseDescriptor.setDefaultRoleInitializer(defaultRoleInitializer);

        // role manager

        IRoleManager roleManager = authInstantiate(conf.role_manager, IRoleManager.class, CassandraRoleManager.class);

        if (authenticator instanceof PasswordAuthenticator && !(roleManager instanceof CassandraRoleManager))

View on GitHub (pinned to 88fd0f6a0e)

Solutions

Set authenticator: PasswordAuthenticator (or another authenticator with requireAuthentication()==true) in cassandra.yaml.
Alternatively, set authorizer: AllowAllAuthorizer if you do not want authentication.
Restart the node after changing both settings consistently.

Example fix

// before (cassandra.yaml)
authenticator: AllowAllAuthenticator
authorizer: CassandraAuthorizer
// after
authenticator: PasswordAuthenticator
authorizer: CassandraAuthorizer

Defensive patterns

Strategy: validation

Validate before calling

// pre-startup sanity check of cassandra.yaml semantics
boolean authRequired = !"AllowAllAuthenticator".equals(conf.authenticator);
boolean authzRequired = !"AllowAllAuthorizer".equals(conf.authorizer);
if (authzRequired && !authRequired) throw new IllegalArgumentException("authorizer requires an authenticating authenticator");

Try / catch

try { DatabaseDescriptor.applyAll(); } catch (ConfigurationException e) { log.fatal("Auth config invalid: " + e.getMessage()); System.exit(1); }

Prevention

Always change authenticator and authorizer together when enabling internal auth.
Validate cassandra.yaml with a config lint/staging startup before rolling to production.
Remember the canonical secure pair: PasswordAuthenticator + CassandraAuthorizer.

When it happens

Trigger: Setting authenticator to AllowAllAuthenticator (or another non-authenticating authenticator) while authorizer is set to a class whose requireAuthorization() returns true (e.g. CassandraAuthorizer) in cassandra.yaml, then starting the node.

Common situations: Operators enabling role/permission-based security but forgetting to switch authenticator from AllowAllAuthenticator to PasswordAuthenticator; partial security hardening of a cluster.

Understand the failure class

Background: Conflicting config options: "cannot be used together" — configuration validation errors across open-source libraries — this error's family across 162 libraries.

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/f9c731574cb73cca. Report an issue: GitHub.