apache/cassandra · error · ConfigurationException

%s requires %s

Error message

%s requires %s

What it means

AuthConfig.applyAuth requires CassandraRoleManager when PasswordAuthenticator is configured, because PasswordAuthenticator stores credentials as internal role hashes managed by CassandraRoleManager. Using any other IRoleManager leaves the authenticator without its expected credential storage, so startup fails with a ConfigurationException of the form '<Authenticator> requires <CassandraRoleManager>'.

Source

Thrown at src/java/org/apache/cassandra/auth/AuthConfig.java:108

                                             authenticator.getClass().getName() + " to enable authentication", false);
        }

        DatabaseDescriptor.setAuthorizer(authorizer);

        // default role initializer: bootstraps the first role on a cluster which has none yet. Instantiated
        // before the role manager because the role manager depends on it (see IRoleManager#defaultRoleInitializer).

        IDefaultRoleInitializer defaultRoleInitializer = authInstantiate(conf.default_role_initializer,
                                                                         IDefaultRoleInitializer.class,
                                                                         PasswordDefaultRoleInitializer.instance);
        DatabaseDescriptor.setDefaultRoleInitializer(defaultRoleInitializer);

        // role manager

        IRoleManager roleManager = authInstantiate(conf.role_manager, IRoleManager.class, CassandraRoleManager.class);

        if (authenticator instanceof PasswordAuthenticator && !(roleManager instanceof CassandraRoleManager))
            throw new ConfigurationException(authenticator.getClass().getName() + " requires " + CassandraRoleManager.class.getName(), false);

        validateDefaultRoleInitializerSupportsRoleManager(conf.default_role_initializer, defaultRoleInitializer, roleManager);

        DatabaseDescriptor.setRoleManager(roleManager);

        // authenticator

        IInternodeAuthenticator internodeAuthenticator = authInstantiate(conf.internode_authenticator,
                                                                         IInternodeAuthenticator.class,
                                                                         AllowAllInternodeAuthenticator.class);
        DatabaseDescriptor.setInternodeAuthenticator(internodeAuthenticator);

        // network authorizer

        INetworkAuthorizer networkAuthorizer = authInstantiate(conf.network_authorizer,
                                                               INetworkAuthorizer.class,
                                                               AllowAllNetworkAuthorizer.class);

View on GitHub (pinned to 88fd0f6a0e)

Solutions

1. Set role_manager: CassandraRoleManager in cassandra.yaml when using PasswordAuthenticator.
2. Or switch to an authenticator that does not require CassandraRoleManager (e.g. certificate-based authenticator).
3. Restart the node after aligning authenticator and role_manager settings.

Example fix

// before (cassandra.yaml)
authenticator: PasswordAuthenticator
role_manager: MyLdapRoleManager
// after
authenticator: PasswordAuthenticator
role_manager: CassandraRoleManager

if ("PasswordAuthenticator".equals(conf.authenticator) && !"CassandraRoleManager".equals(conf.role_manager))
    throw new IllegalArgumentException("PasswordAuthenticator requires CassandraRoleManager");

try { startCassandra(); } catch (ConfigurationException e) { log.fatal("role_manager/authenticator mismatch: " + e.getMessage()); }

When it happens

Trigger: Configuring authenticator: PasswordAuthenticator together with role_manager set to any IRoleManager other than CassandraRoleManager in cassandra.yaml.

Common situations: Operators using a custom/external role manager (e.g. LDAP-backed) while keeping PasswordAuthenticator; migrating role management without switching authenticators.

Understand the failure class

Background: Conflicting config options: "cannot be used together" — configuration validation errors across open-source libraries — this error's family across 162 libraries.

Related errors

• %s does not support %s
• %s has authorization enabled which requires %s to enable aut
• %s can't be used with %s
• Failed to instantiate %s
• Unsupported parameter '%s' for %s, supported parameters are

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/948fb6195b177843. Report an issue: GitHub.