apache/cassandra · error · RuntimeException

Unsupported client auth

Error message

Unsupported client auth 

What it means

toNettyClientAuth maps the configured require_client_auth enum (ClientAuth enum) to Netty's ClientAuth mode. The default branch throws if the enum value is unrecognized, which in practice can only happen with an unexpected null or a future/foreign enum constant. It is an internal exhaustiveness guard.

Solutions

1. Check the require_client_auth value configured; use only true/false (mapped to REQUIRE/NOT_REQUIRED).
2. If a new ClientAuth constant was added to the codebase, add a corresponding case to the switch in toNettyClientAuth.
3. Ensure callers never pass null; default require_client_auth explicitly in config parsing.

Example fix

// before
switch (clientAuth) { case REQUIRE: return ClientAuth.REQUIRE; ... default: throw new RuntimeException("Unsupported client auth " + clientAuth); }
// after
switch (clientAuth) { case REQUIRE: return ClientAuth.REQUIRE; case NOT_REQUIRED: return ClientAuth.NONE; case OPTIONAL: return ClientAuth.OPTIONAL; case NEW_MODE: return ClientAuth.OPTIONAL; default: throw new RuntimeException("Unsupported client auth " + clientAuth); }

if (clientAuth != ClientAuth.REQUIRE && clientAuth != ClientAuth.NOT_REQUIRED && clientAuth != ClientAuth.OPTIONAL)
    throw new IllegalArgumentException("Unsupported client auth: " + clientAuth);

boolean isKnownClientAuth(ClientAuth a) { return a != null && EnumSet.of(ClientAuth.REQUIRE, ClientAuth.NOT_REQUIRED, ClientAuth.OPTIONAL).contains(a); }

try { ClientAuth netty = toNettyClientAuth(clientAuth); } catch (RuntimeException e) { /* map to config error, fail fast at startup */ }

When it happens

Trigger: createNettySslContext calls toNettyClientAuth with a ClientAuth value not covered by REQUIRE/NOT_REQUIRED/OPTIONAL — effectively only null or an unknown constant.

Common situations: Programming errors after adding a new ClientAuth enum constant without updating this switch, or reflection/serialization code injecting a bogus value.

Related errors

• is not a valid ClientAuth option
• Unknown column type: " + type
• Bad CMS state:
• Can not create a keyspace with MetaReplicationStrategy
• Certificate for expired on

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/ee8df444c89487be. Report an issue: GitHub.

Appendix: source

Thrown at src/java/org/apache/cassandra/security/AbstractSslContextFactory.java:306

     * Create a {@code KeyManagerFactory} for outbound connections.
     * It provides a seperate keystore for internode mTLS outbound connections.
     * @return {@code KeyManagerFactory}
     * @throws SSLException
     */
    abstract protected KeyManagerFactory buildOutboundKeyManagerFactory() throws SSLException;

    private ClientAuth toNettyClientAuth(EncryptionOptions.ClientEncryptionOptions.ClientAuth clientAuth)
    {
        switch (clientAuth)
        {
            case REQUIRED:
                return ClientAuth.REQUIRE;
            case NOT_REQUIRED:
                return ClientAuth.NONE;
            case OPTIONAL:
                return ClientAuth.OPTIONAL;
            default:
                throw new RuntimeException("Unsupported client auth " + clientAuth);
        }
    }
}

View on GitHub (pinned to 88fd0f6a0e)