apache/cassandra · error · ConfigurationException

requires a non-empty ' ' parameter

Error message

%s requires a non-empty '%s' parameter

What it means

ConfigurationException from MutualTlsDefaultRoleInitializer.validateConfiguration: a required parameter (role or identity, named in the message) is null or empty in the cassandra.yaml section for the role initializer. It is a startup-time guard that names the class and the missing parameter name.

Solutions

1. Set the missing parameter (role or identity) to a non-empty value in the role initializer configuration
2. Ensure the yaml indentation and parameter names match the class's expected options
3. Rerun with validated config; startup will fail fast until both role and identity are provided

When it happens

Trigger: Thrown at src/java/org/apache/cassandra/auth/MutualTlsDefaultRoleInitializer.java:103 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/5e72aba6811ed9cf. Report an issue: GitHub.

Appendix: source

Thrown at src/java/org/apache/cassandra/auth/MutualTlsDefaultRoleInitializer.java:103

                                     escapeCqlLiteral(role)),
                       String.format("INSERT INTO %s.%s (role, is_superuser, can_login) " +
                                     "VALUES ('%s', true, true) USING TIMESTAMP 0",
                                     SchemaConstants.AUTH_KEYSPACE_NAME,
                                     AuthKeyspace.ROLES,
                                     escapeCqlLiteral(role)));
    }

    @Override
    public String defaultRoleName()
    {
        return role;
    }

    @Override
    public void validateConfiguration() throws ConfigurationException
    {
        if (Strings.isNullOrEmpty(role))
            throw new ConfigurationException(String.format("%s requires a non-empty '%s' parameter",
                                                           getClass().getSimpleName(), ROLE));

        if (Strings.isNullOrEmpty(identity))
            throw new ConfigurationException(String.format("%s requires a non-empty '%s' parameter",
                                                           getClass().getSimpleName(), IDENTITY));

        // The role this creates has no password, so an authenticator which cannot authenticate by certificate
        // would leave a freshly bootstrapped cluster with no way to log in at all.
        IAuthenticator authenticator = DatabaseDescriptor.getAuthenticator();
        Set<IAuthenticator.AuthenticationMode> modes = authenticator.getSupportedAuthenticationModes();
        if (authenticator.requireAuthentication() && !modes.isEmpty() && !modes.contains(IAuthenticator.AuthenticationMode.MTLS))
        {
            throw new ConfigurationException(String.format("%s creates a role with no password, which %s cannot " +
                                                           "authenticate (supported modes: %s). Configure an " +
                                                           "authenticator supporting mutual TLS, such as %s.",
                                                           getClass().getSimpleName(),
                                                           authenticator.getClass().getSimpleName(),
                                                           modes,

View on GitHub (pinned to 88fd0f6a0e)