apache/cassandra · error · InvalidRequestException

You have to enable password_policy and its…

Error message

You have to enable password_policy and its generator_class_name property in cassandra.yaml to be able to generate passwords.

What it means

ALTER ROLE ... WITH PASSWORD = <generated> (isGeneratedPassword) delegates password creation to Guardrails.passwordPolicy.generate(). This InvalidRequestException is thrown when the generator returns null, which happens when password_policy (and its generator_class_name) is not enabled in cassandra.yaml.

Solutions

  1. Enable password_policy in cassandra.yaml and set password_policy.generator_class_name to a valid generator implementation, then restart the node
  2. Provide an explicit password instead of the generated form: ALTER ROLE x WITH PASSWORD = 'secret'
  3. Verify config was rolled out to the node the client is connected to

Example fix

// before (cassandra.yaml)
# password_policy not configured
// after (cassandra.yaml)
password_policy:
  enabled: true
  generator_class_name: org.apache.cassandra.auth.GeneratePasswordHashingPolicy # example implementation
Defensive patterns

Strategy: validation

Validate before calling

// check cassandra.yaml before using generated passwords
// password_policy:
//   enabled: true
//   generator_class_name: <implementation>
boolean enabled = org.apache.cassandra.config.DatabaseDescriptor.getRawConfig().password_policy != null
                  && org.apache.cassandra.config.DatabaseDescriptor.getRawConfig().password_policy.enabled;

Try / catch

try { session.execute("ALTER ROLE r WITH PASSWORD = <generated>"); }
catch (InvalidRequestException e) {
    if (e.getMessage().contains("password_policy")) { /* fall back to explicit password or fix config */ }
}

Prevention

When it happens

Trigger: Executing ALTER ROLE ... WITH PASSWORD = <generated> (or the generated-password CQL path) on a cluster whose cassandra.yaml lacks password_policy enabled with a configured generator_class_name, so the generator produces null.

Common situations: Operators using the generated-password feature (often via cqlsh or provisioning scripts) without enabling the password policy guardrail in the cluster config; config present on one node but the statement hits a node with default config.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/3f560c6c3791c996. Report an issue: GitHub.

Appendix: source

Thrown at src/java/org/apache/cassandra/cql3/statements/AlterRoleStatement.java:146

        else
        {
            // if not attempting to alter another role, ensure we have ALTER permissions on it
            super.checkPermission(state, Permission.ALTER, role);
        }
    }

    public ResultMessage execute(ClientState state) throws RequestValidationException, RequestExecutionException
    {
        if (ifExists && !DatabaseDescriptor.getRoleManager().isExistingRole(role))
            return null;

        if (opts.isGeneratedPassword())
        {
            String generatedPassword = Guardrails.passwordPolicy.generate(state, Map.of());
            if (generatedPassword != null)
                opts.setOption(IRoleManager.Option.PASSWORD, generatedPassword);
            else
                throw new InvalidRequestException("You have to enable password_policy and its generator_class_name property " +
                                                  "in cassandra.yaml to be able to generate passwords.");
        }

        if (opts.getPassword().isPresent())
            Guardrails.passwordPolicy.validate(opts.getPassword().get(), state);

        ResultMessage resultMessage = null;
        if (!opts.isEmpty())
            resultMessage = DatabaseDescriptor.getRoleManager().alterRoleWithResult(state.getUser(), role, opts);

        if (dcPermissions != null)
            DatabaseDescriptor.getNetworkAuthorizer().setRoleDatacenters(role, dcPermissions);

        if (cidrPermissions != null)
            DatabaseDescriptor.getCIDRAuthorizer().setCidrGroupsForRole(role, cidrPermissions);

        return resultMessage;
    }

View on GitHub (pinned to 88fd0f6a0e)