apache/cassandra · error · ConfigurationException

of value is less or equal to of value

Error message

%s of value %s is less or equal to %s of value %s

What it means

The password-length guardrail enforces strict ordering: max_length must be strictly greater than length_warn, otherwise warn would fire at or beyond the hard cap. validateParameters throws this ConfigurationException when maxLength <= lengthWarn.

Solutions

1. Raise max_length so it is strictly greater than length_warn (and <= CassandraPasswordConfiguration.MAX_LENGTH = 1000).
2. Lower length_warn so it is strictly below max_length.
3. Reset both to defaults (max_length=1000, length_warn=12) if unsure.

Example fix

// before
password_strength:
  max_length: 12
  length_warn: 12
// after
password_strength:
  max_length: 64
  length_warn: 12

int maxLength = resolveInt(config, "max_length", 1000);
int lengthWarn = resolveInt(config, "length_warn", 12);
if (maxLength <= lengthWarn)
    throw new IllegalArgumentException("max_length must be strictly greater than length_warn");

try {
    new CassandraPasswordConfiguration(cfg);
} catch (ConfigurationException e) {
    logger.error("Invalid password guardrail config: {}", e.getMessage());
}

When it happens

Trigger: Configuring max_length <= length_warn, e.g. max_length=10 with length_warn=10 or 12, in cassandra.yaml or CustomGuardrailConfig.

Common situations: Raising length_warn without raising max_length, lowering max_length below an existing warn threshold, or mixing defaults (max_length=1000) with a custom warn above it.

Understand the failure class

Background: Conflicting config options: "cannot be used together" — configuration validation errors across open-source libraries — this error's family across 162 libraries.

Related errors

• DC weights must be zero or positive
• Fan factor cannot be lower than 2 in
• Invalid configuration
• Invalid configuration
• Invalid guardrails configuration:

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/49ff7f163d1e99c8. Report an issue: GitHub.

Appendix: source

Thrown at src/java/org/apache/cassandra/db/guardrails/CassandraPasswordConfiguration.java:185

        if (characteristicsFail < 0) throw mustBePositiveException(CHARACTERISTIC_FAIL_KEY);
        if (lowerCaseWarn < 0) throw mustBePositiveException(LOWER_CASE_WARN_KEY);
        if (lowerCaseFail < 0) throw mustBePositiveException(LOWER_CASE_FAIL_KEY);
        if (upperCaseWarn < 0) throw mustBePositiveException(UPPER_CASE_WARN_KEY);
        if (upperCaseFail < 0) throw mustBePositiveException(UPPER_CASE_FAIL_KEY);
        if (specialsWarn < 0) throw mustBePositiveException(SPECIAL_WARN_KEY);
        if (specialsFail < 0) throw mustBePositiveException(SPECIAL_FAIL_KEY);
        if (digitsWarn < 0) throw mustBePositiveException(DIGIT_WARN_KEY);
        if (digitsFail < 0) throw mustBePositiveException(DIGIT_FAIL_KEY);
        if (lengthWarn < 0) throw mustBePositiveException(LENGTH_WARN_KEY);
        if (lengthFail < 0) throw mustBePositiveException(LENGTH_FAIL_KEY);

        if (MAX_LENGTH < maxLength)
            throw new ConfigurationException(format("%s can not be greater than %s",
                                                    MAX_LENGTH_KEY,
                                                    MAX_LENGTH));

        if (maxLength <= lengthWarn)
            throw getValidationException(MAX_LENGTH_KEY, maxLength, LENGTH_WARN_KEY, lengthWarn);

        if (lengthWarn <= lengthFail)
            throw getValidationException(LENGTH_WARN_KEY, lengthWarn, LENGTH_FAIL_KEY, lengthFail);

        if (specialsWarn <= specialsFail)
            throw getValidationException(SPECIAL_WARN_KEY,
                                         specialsWarn,
                                         SPECIAL_FAIL_KEY,
                                         specialsFail);

        if (digitsWarn <= digitsFail)
            throw getValidationException(DIGIT_WARN_KEY,
                                         digitsWarn,
                                         DIGIT_FAIL_KEY,
                                         digitsFail);

        if (upperCaseWarn <= upperCaseFail)
            throw getValidationException(UPPER_CASE_WARN_KEY,

View on GitHub (pinned to 88fd0f6a0e)