apache/cassandra · error · ProtocolException

SASL Authentication is not supported in version 1 of the pro

Error message

SASL Authentication is not supported in version 1 of the protocol

What it means

AuthResponse.decode rejects SASL authentication frames on protocol version 1, which predates the AUTHENTICATE/AUTH_RESPONSE mechanism. Sending an AUTH_RESPONSE message while negotiating with ProtocolVersion.V1 throws this ProtocolException.

Source

Thrown at src/java/org/apache/cassandra/transport/messages/AuthResponse.java:43

import org.apache.cassandra.transport.Message;
import org.apache.cassandra.transport.ProtocolException;
import org.apache.cassandra.transport.ProtocolVersion;

import io.netty.buffer.ByteBuf;

/**
 * A SASL token message sent from client to server. Some SASL
 * mechanisms and clients may send an initial token before
 * receiving a challenge from the server.
 */
public class AuthResponse extends Message.Request
{
    public static final Message.Codec<AuthResponse> codec = new Message.Codec<AuthResponse>()
    {
        public AuthResponse decode(ByteBuf body, ProtocolVersion version)
        {
            if (version == ProtocolVersion.V1)
                throw new ProtocolException("SASL Authentication is not supported in version 1 of the protocol");

            ByteBuffer b = CBUtil.readValue(body);
            byte[] token = new byte[b.remaining()];
            b.get(token);
            return new AuthResponse(token);
        }

        public void encode(AuthResponse response, ByteBuf dest, ProtocolVersion version)
        {
            CBUtil.writeValue(response.token, dest);
        }

        public int encodedSize(AuthResponse response, ProtocolVersion version)
        {
            return CBUtil.sizeOfValue(response.token);
        }
    };

View on GitHub (pinned to 88fd0f6a0e)

Solutions

1. Upgrade the client to protocol v2 or later (v3+ recommended).
2. Temporarily disable the server authenticator (AllowAllAuthenticator) only for legacy v1 testing.
3. Ensure the negotiated version is not silently falling back to v1; set the version explicitly in the client.
4. If using SimpleClient, pass a modern ProtocolVersion to the constructor/initializer.

Example fix

// before
SimpleClient client = new SimpleClient(host, port, ProtocolVersion.V1);
// after
SimpleClient client = new SimpleClient(host, port, ProtocolVersion.V4);

if (version == ProtocolVersion.V1 && authenticatorConfigured)
    throw new IllegalStateException("Auth requires protocol v2+; negotiated v1");

try { authResponse(); } catch (ProtocolException e) { if (e.getMessage().contains("not supported in version 1")) upgradeProtocolVersion(); }

When it happens

Trigger: A client forced to (or defaulting to) protocol v1 sends an AUTH_RESPONSE after the server replies AUTHENTICATE (server has an authenticator configured, e.g. PasswordAuthenticator).

Common situations: Legacy clients pinned to v1 connecting to clusters with authentication enabled; downgrading protocol version for compatibility testing while auth is still required.

Understand the failure class

Background: UnsupportedOperationException and "is not supported" errors: when a library deliberately refuses a call — this error's family across 30 libraries.

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• SASL negotiation not complete
• Credential format error: username or password is empty or co
• Password must not be null
• Authentication ID must not be null
• Auth check after connection closed

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/5f34e62c78d07d08. Report an issue: GitHub.