apache/cassandra · error · ConfigurationException

The shortest password to pass the failing validator for any

Error message

The shortest password to pass the failing validator for any %s characteristics out of %s is %s but you have set the %s to %s.

What it means

Cassandra's password guardrail configuration validates that the configured maximum failing-password length (cassandra.password_validator.length_fail) is at least as long as the sum of the minimum lengths of the shortest N failing characteristics (N = characteristics_fail). If the sum of the minimum per-characteristic lengths exceeds the configured length_fail, no valid password could ever be configured consistently, so a ConfigurationException is thrown at validation time.

Source

Thrown at src/java/org/apache/cassandra/db/guardrails/CassandraPasswordConfiguration.java:268

        if (minimumLenghtOfWarnCharacteristics > lengthWarn)
            throw new ConfigurationException(format("The shortest password to pass the warning validator for any %s " +
                                                    "characteristics out of %s is %s but you have set the %s to %s.",
                                                    characteristicsWarn,
                                                    MAX_CHARACTERISTICS,
                                                    minimumLenghtOfWarnCharacteristics,
                                                    LENGTH_WARN_KEY,
                                                    lengthWarn));

        int[] minimumLengthsFail = new int[]{ specialsFail, digitsFail,
                                              upperCaseFail, lowerCaseFail };
        Arrays.sort(minimumLengthsFail);

        int minimumLenghtOfFailCharacteristics = 0;
        for (int i = 0; i < characteristicsFail; i++)
            minimumLenghtOfFailCharacteristics += minimumLengthsFail[i];

        if (minimumLenghtOfFailCharacteristics > lengthFail)
            throw new ConfigurationException(format("The shortest password to pass the failing validator for any %s " +
                                                    "characteristics out of %s is %s but you have set the %s to %s.",
                                                    characteristicsFail,
                                                    MAX_CHARACTERISTICS,
                                                    minimumLenghtOfFailCharacteristics,
                                                    LENGTH_FAIL_KEY,
                                                    lengthFail));

        if (dictionary != null)
        {
            File dictionaryFile = new File(dictionary);
            if (!dictionaryFile.exists())
                throw new ConfigurationException(format("Dictionary file %s does not exist.", dictionary));

            if (!dictionaryFile.isReadable())
                throw new ConfigurationException(format("Dictionary file %s is not readable.", dictionary));
        }
    }

View on GitHub (pinned to 88fd0f6a0e)

Solutions

  1. Increase length_fail so it is greater than or equal to the sum of the minimum lengths of the shortest characteristicsFail characteristics
  2. Decrease characteristics_fail so fewer characteristics must fail and the summed minimum length fits under length_fail
  3. Verify the configured values with the exact numbers printed in the exception (shortest valid sum vs. current length_fail)

Example fix

// before
cassandra.yaml: length_fail: 8, characteristics_fail: 3 (min lengths sum = 12)
// after
cassandra.yaml: length_fail: 12, characteristics_fail: 3  # or reduce characteristics_fail to 2
Defensive patterns

Strategy: validation

Validate before calling

int[] minLens = ...; // per-characteristic minimum lengths from config
int sum = 0;
for (int i = 0; i < characteristicsFail; i++) sum += minLens[i];
if (sum > lengthFail) throw new IllegalArgumentException("length_fail must be >= " + sum);

Try / catch

try {
    applyGuardrailConfig(config);
} catch (ConfigurationException e) {
    if (e.getMessage().contains("The shortest password")) {
        logger.error("length_fail too small: {}", e.getMessage());
        // fall back to previous config
    }
}

Prevention

When it happens

Trigger: Calling validateParameters (directly or via CassandraPasswordConfiguration construction / guardrail config parsing) with characteristics_fail N and length_fail L where minLen[0]+...+minLen[N-1] > L, e.g. setting length_fail lower than the combined minimum lengths of the characteristics expected to fail.

Common situations: Operators tighten length_fail in cassandra.yaml (or via ALTER ... guardrail settings) without realizing the shortest-combination rule; copying config from a cluster with different characteristic minimums; typo'ing the length_fail value (e.g. dropping a digit).

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/908f8754df357ffc. Report an issue: GitHub.