apache/cassandra · error · ConfigurationException

The shortest password to pass the warning validator for any

Error message

The shortest password to pass the warning validator for any %s characteristics out of %s is %s but you have set the %s to %s.

What it means

Thrown as a ConfigurationException during validateParameters when the per-characteristic minimum length thresholds are individually satisfiable but their combination is not: the sum of the shortest lengths of the 'characteristicsWarn' best characteristics exceeds the configured lengthWarn. In other words, no password of lengthWarn could ever pass the warning validator, so the config is rejected with a message stating the computed minimum password length.

Source

Thrown at src/java/org/apache/cassandra/db/guardrails/CassandraPasswordConfiguration.java:251

                                                    characteristicsWarn));

        if (characteristicsFail > characteristicsWarn)
            throw new ConfigurationException(format("%s can not be bigger than %s. You have set %s and %s respectively.",
                                                    CHARACTERISTIC_FAIL_KEY,
                                                    CHARACTERISTIC_WARN_KEY,
                                                    characteristicsFail,
                                                    characteristicsWarn));

        int[] minimumLengthsWarn = new int[]{ specialsWarn, digitsWarn,
                                              upperCaseWarn, lowerCaseWarn };
        Arrays.sort(minimumLengthsWarn);

        int minimumLenghtOfWarnCharacteristics = 0;
        for (int i = 0; i < characteristicsWarn; i++)
            minimumLenghtOfWarnCharacteristics += minimumLengthsWarn[i];

        if (minimumLenghtOfWarnCharacteristics > lengthWarn)
            throw new ConfigurationException(format("The shortest password to pass the warning validator for any %s " +
                                                    "characteristics out of %s is %s but you have set the %s to %s.",
                                                    characteristicsWarn,
                                                    MAX_CHARACTERISTICS,
                                                    minimumLenghtOfWarnCharacteristics,
                                                    LENGTH_WARN_KEY,
                                                    lengthWarn));

        int[] minimumLengthsFail = new int[]{ specialsFail, digitsFail,
                                              upperCaseFail, lowerCaseFail };
        Arrays.sort(minimumLengthsFail);

        int minimumLenghtOfFailCharacteristics = 0;
        for (int i = 0; i < characteristicsFail; i++)
            minimumLenghtOfFailCharacteristics += minimumLengthsFail[i];

        if (minimumLenghtOfFailCharacteristics > lengthFail)
            throw new ConfigurationException(format("The shortest password to pass the failing validator for any %s " +
                                                    "characteristics out of %s is %s but you have set the %s to %s.",

View on GitHub (pinned to 88fd0f6a0e)

Solutions

1. Increase length_warn in cassandra.yaml to at least the minimum length reported in the error message
2. Decrease the per-characteristic warn minimums (specials_warn, digits_warn, etc.) so their k-smallest sum fits within length_warn
3. Recompute and test the combined configuration on a staging node before rollout

Example fix

// before
password_guardrails:
  length_warn: 8
  specials_warn: 3
  digits_warn: 3
// after
password_guardrails:
  length_warn: 12
  specials_warn: 3
  digits_warn: 3

int[] mins = {specialsWarn, digitsWarn, lowerWarn, upperWarn};
Arrays.sort(mins);
int shortest = 0;
for (int i = 0; i < characteristicsWarn; i++) shortest += mins[i];
if (shortest > lengthWarn)
    throw new ConfigurationException("Shortest passing warn password is " + shortest + " but length_warn is " + lengthWarn);

try { loadGuardrailConfig(); }
catch (ConfigurationException e) {
    if (e.getMessage().contains("shortest password")) { /* raise length_warn or lower characteristic minimums */ }
    throw e;
}

When it happens

Trigger: Configuring cassandra.yaml password guardrails with per-characteristic warn minimums (specials_warn, digits_warn, lower/upper_warn, etc.) whose k-smallest sum exceeds length_warn, e.g. requiring a total minimum length below what the individual characteristic minimums force.

Common situations: Raising length_warn downward or raising individual characteristic minimums upward independently, breaking the implicit invariant; admins tuning thresholds one at a time without rechecking the combination; copying partial configs from another cluster.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• must be positive.
• Illegal sequence length can not be lower than %s.
• Invalid guardrails configuration:
• default_keyspace_rf to be set (%d) cannot be less than minim
• default_keyspace_rf to be set (%d) cannot be greater than ma

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/b6d3ea0539e0541a. Report an issue: GitHub.