apache/cassandra · error · ConfigurationException

must be positive.

Error message

%s must be positive.

What it means

This ConfigurationException is thrown by CassandraPasswordConfiguration.validateParameters when the max_length password guardrail setting resolves to a negative integer. Password guardrail configuration parameters must be non-negative because they represent thresholds (character counts); a negative value is meaningless and rejected at construction time when the guardrail is loaded from CustomGuardrailConfig.

Solutions

1. Open cassandra.yaml (or the guardrail config source) and set `max_length` to a non-negative integer, e.g. max_length: 128.
2. If you intended 'no maximum', use a large positive sentinel value rather than a negative number, since the validation only accepts >= 0.
3. If the value comes from an environment variable or config generator, fix the source so it never emits negatives, and re-run validateParameters or restart the node.

Example fix

// before (cassandra.yaml guardrail config)
max_length: -1

// after
max_length: 128

int maxLength = resolveInt("max_length", DEFAULT_MAX_LENGTH);
if (maxLength < 0)
    throw new IllegalArgumentException("max_length must be >= 0");

// startup config load
try {
    new CassandraPasswordConfiguration(config);
} catch (ConfigurationException e) {
    logger.error("Invalid password guardrail config: {}", e.getMessage());
    throw e; // fail fast; do not start with broken guardrails
}

When it happens

Trigger: Setting the `max_length` key to a negative integer in the password guardrail configuration (cassandra.yaml guardrails section or guardrail config map) and then instantiating CassandraPasswordConfiguration; calling validateParameters() after programmatically setting maxLength < 0.

Common situations: Typo in config where a negative sign slips in; operator copying a threshold value from another system where -1 means 'unlimited', which this implementation does not support; automated config generation producing -1 defaults; misunderstanding that 0 is allowed but negatives are not.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• It was not possible to generate a valid password in
• The shortest password to pass the failing validator for any
• default_keyspace_rf to be set
• default_keyspace_rf to be set
• Dictionary file does not exist.

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/e42d3b5158f8a2c7. Report an issue: GitHub.

Appendix: source

Thrown at src/java/org/apache/cassandra/db/guardrails/CassandraPasswordConfiguration.java:165

        specialsWarn = config.resolveInteger(SPECIAL_WARN_KEY, DEFAULT_SPECIAL_WARN);
        specialsFail = config.resolveInteger(SPECIAL_FAIL_KEY, DEFAULT_SPECIAL_FAIL);

        illegalSequenceLength = config.resolveInteger(ILLEGAL_SEQUENCE_LENGTH_KEY, DEFAULT_ILLEGAL_SEQUENCE_LENGTH);
        dictionary = config.resolveString(DICTIONARY_KEY);
        detailedMessages = config.resolveBoolean(DETAILED_MESSAGES_KEY, true);

        validateParameters();
    }

    ConfigurationException mustBePositiveException(String parameter)
    {
        throw new ConfigurationException(parameter + " must be positive.");
    }

    public void validateParameters() throws ConfigurationException
    {
        if (maxLength < 0) throw mustBePositiveException(MAX_LENGTH_KEY);
        if (characteristicsWarn < 0) throw mustBePositiveException(CHARACTERISTIC_WARN_KEY);
        if (characteristicsFail < 0) throw mustBePositiveException(CHARACTERISTIC_FAIL_KEY);
        if (lowerCaseWarn < 0) throw mustBePositiveException(LOWER_CASE_WARN_KEY);
        if (lowerCaseFail < 0) throw mustBePositiveException(LOWER_CASE_FAIL_KEY);
        if (upperCaseWarn < 0) throw mustBePositiveException(UPPER_CASE_WARN_KEY);
        if (upperCaseFail < 0) throw mustBePositiveException(UPPER_CASE_FAIL_KEY);
        if (specialsWarn < 0) throw mustBePositiveException(SPECIAL_WARN_KEY);
        if (specialsFail < 0) throw mustBePositiveException(SPECIAL_FAIL_KEY);
        if (digitsWarn < 0) throw mustBePositiveException(DIGIT_WARN_KEY);
        if (digitsFail < 0) throw mustBePositiveException(DIGIT_FAIL_KEY);
        if (lengthWarn < 0) throw mustBePositiveException(LENGTH_WARN_KEY);
        if (lengthFail < 0) throw mustBePositiveException(LENGTH_FAIL_KEY);

        if (MAX_LENGTH < maxLength)
            throw new ConfigurationException(format("%s can not be greater than %s",
                                                    MAX_LENGTH_KEY,
                                                    MAX_LENGTH));

View on GitHub (pinned to 88fd0f6a0e)