apache/cassandra · error · org.apache.cassandra.exceptions.ConfigurationException

%s is not a valid ClientAuth option

Error message

%s is not a valid ClientAuth option

What it means

EncryptionOptions.ClientAuth.from parses the client-auth mode (e.g. 'require', 'optional', 'want', 'disabled', case-insensitively). Unrecognized strings raise ConfigurationException. Note the code as shown throws '<value> is not a valid ClientAuth option'.

Source

Thrown at src/java/org/apache/cassandra/config/EncryptionOptions.java:764

                for (ClientAuth clientAuth : ClientAuth.values())
                {
                    VALUES.put(clientAuth.value, clientAuth);
                    VALUES.put(toLowerCaseLocalized(clientAuth.name()), clientAuth);
                }
            }

            ClientAuth(String value)
            {
                this.value = value;
            }

            public static ClientAuth from(String value)
            {
                if (VALUES.containsKey(toLowerCaseLocalized(value)))
                {
                    return VALUES.get(toLowerCaseLocalized(value));
                }
                throw new ConfigurationException(value + " is not a valid ClientAuth option");
            }

            public String value()
            {
                return value;
            }
        }

        public static class Builder extends EncryptionOptions.Builder<ClientEncryptionOptions>
        {
            public Builder()
            {
                this(new ClientEncryptionOptions());
            }

            public Builder(ClientEncryptionOptions options)
            {
                super(options);

View on GitHub (pinned to 88fd0f6a0e)

Solutions

1. Replace the value with a valid option: require, optional, want, or disabled (case-insensitive)
2. Convert legacy boolean values: true -> require, false -> optional (per your intended policy)
3. Consult the EncryptionOptions.ClientAuth enum in your Cassandra version for exact accepted values

Example fix

// before
client_encryption_options:
  require_client_auth: yes
// after
client_encryption_options:
  require_client_auth: require

private static final Set<String> CLIENT_AUTH = Set.of("require","optional","want","disabled");
static String normalizeClientAuth(String v) {
    String lower = v == null ? null : v.toLowerCase(Locale.ROOT);
    if (!CLIENT_AUTH.contains(lower)) throw new IllegalArgumentException("Invalid ClientAuth: " + v);
    return lower;
}

try {
    EncryptionOptions.ClientAuth.from(cfgValue);
} catch (ConfigurationException e) {
    logger.error("Bad client auth setting: {}", e.getMessage());
}

When it happens

Trigger: cassandra.yaml with client_encryption_options.require_client_auth or related field set to an unrecognized string like 'true', 'yes', 'REQUIRED' (plural), or a misspelled mode.

Common situations: Migrating from boolean require_client_auth (true/false) to the ClientAuth enum without converting values; typos or wrong-cased expectations in YAML.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

• Must be one of ${values}
• Invalid value for environment variable '${key}': expected on
• Invalid value for system propery '%s': expected one of %s (c
• Unsupported data rate unit: %s. Supported units are: %s
• Failed to initialize SSL

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/c03af6e63f78c081. Report an issue: GitHub.