apache/cassandra · error · AuthenticationException

Unable to perform authentication:

Error message

Unable to perform authentication: 

What it means

Wraps a RequestExecutionException from querying the salted hash in system_auth.roles as an AuthenticationException. This is an infrastructure-level failure (query timeout, unavailability, schema mismatch) rather than wrong credentials — authentication could not be performed at all.

Source

Thrown at src/java/org/apache/cassandra/auth/PasswordAuthenticator.java:229

            ResultMessage.Rows rows = select(authenticateStatement, options);

            // If either a non-existent role name was supplied, or no credentials
            // were found for that role, we don't want to cache the result so we
            // return a sentinel value. On receiving the sentinel, the caller can
            // invalidate the cache and throw an appropriate exception.
            if (rows.result.isEmpty())
                return NO_SUCH_CREDENTIAL;

            UntypedResultSet result = UntypedResultSet.create(rows.result);
            if (!result.one().has(SALTED_HASH))
                return NO_SUCH_CREDENTIAL;

            return result.one().getString(SALTED_HASH);
        }
        catch (RequestExecutionException e)
        {
            throw new AuthenticationException("Unable to perform authentication: " + e.getMessage(), e);
        }
    }

    @VisibleForTesting
    ResultMessage.Rows select(SelectStatement statement, QueryOptions options)
    {
        return statement.execute(QueryState.forInternalCalls(), options, Dispatcher.RequestTime.forImmediateExecution());
    }

    public Set<DataResource> protectedResources()
    {
        // Also protected by CassandraRoleManager, but the duplication doesn't hurt and is more explicit
        return Set.of(DataResource.table(SchemaConstants.AUTH_KEYSPACE_NAME, AuthKeyspace.ROLES));
    }

    public void validateConfiguration() throws ConfigurationException
    {
    }

View on GitHub (pinned to 88fd0f6a0e)

Solutions

1. Check node health and logs for the underlying RequestExecutionException
2. Ensure system_auth is replicated to at least RF nodes that are all up (nodetool repair system_auth)
3. Retry authentication after the cluster is healthy
4. Increase read timeouts if consistently timing out under load

Example fix

// before: auth fails while node is down
$ nodetool status
// after: repair system_auth and retry
$ nodetool repair system_auth
$ cqlsh -u appuser -p s3cret

// check cluster health before auth-dependent operations
nodetool status  # ensure all system_auth replicas are up

try { session = cluster.connect(); }
catch (AuthenticationException e) {
    if (e.getMessage().startsWith("Unable to perform authentication")) retryWithBackoff();
}

When it happens

Trigger: SELECT on system_auth.roles fails while queryHashedPassword executes: coordinator timeout, insufficient live replicas for system_auth's replication factor, node down, or schema disagreement.

Common situations: system_auth under-replicated with a dead node; heavy load causing read timeouts on the roles query; running repair/replacement during authentication.

Understand the failure class

Background: Database query failed: Internal Server Error 500s wrapping SQL, Prisma, and connection failures — what to check first — this error's family across 16 libraries.

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Unable to perform authentication: ${e.getMessage()}
• Provided username %s and/or password are incorrect
• Required key '%s' is missing
• Required key '%s' is missing for provided username %s
• SASL negotiation not complete

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/f00bcf92dcc80d1d. Report an issue: GitHub.