apache/cassandra · error · InvalidRequestException

You have to enable role_name_policy and its…

Error message

You have to enable role_name_policy and its generator_class_name property in cassandra.yaml to be able to generate role names.

What it means

When CREATE ROLE is issued without an explicit role name (generated-role path), Cassandra asks Guardrails.roleNamePolicy to generate the name. If the role_name_policy guardrail (or its generator_class_name) is not configured in cassandra.yaml, generate() returns null and this InvalidRequestException is thrown.

Solutions

Enable role_name_policy in cassandra.yaml and set its generator_class_name to a valid IRoleNamePolicy implementation, then restart the node.
Alternatively, provide an explicit role name in the CREATE ROLE statement instead of relying on generation.

Example fix

# before (cassandra.yaml)
# role_name_policy not configured
# after
role_name_policy:
  enabled: true
  generator_class_name: org.apache.cassandra.db.guardrails.CustomRoleNameGenerator

Defensive patterns

Strategy: validation

Validate before calling

// ops check before using generated role names
// verify in cassandra.yaml on every node:
//   role_name_policy enabled with a valid generator_class_name
assert yamlConfig.role_name_policy && yamlConfig.role_name_policy.generator_class_name != null;

Try / catch

try { session.execute(generatedRoleCql); } catch (InvalidRequestException e) { if (e.getMessage().contains("role_name_policy")) { /* enable policy in yaml or fall back to explicit name */ } else throw e; }

Prevention

Enable role_name_policy and generator_class_name in cassandra.yaml before adopting generated role names
Include guardrail config in cluster deployment smoke tests
Keep explicit role names as a fallback in application config

When it happens

Trigger: A client issues the generated-role form of CREATE ROLE (role == RoleResource.GENERATED_ROLE) while role_name_policy is disabled or lacks generator_class_name in cassandra.yaml, so roleNamePolicy.generate(state, options) yields null.

Common situations: Clusters upgraded where the new role_name_policy guardrail was never enabled; mis-edited cassandra.yaml omitting generator_class_name; applications adopting generated role names without coordinating server config.

Related errors

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/05c7aef034208726. Report an issue: GitHub.

Appendix: source

Thrown at src/java/org/apache/cassandra/cql3/statements/CreateRoleStatement.java:114

        if (!ifNotExists && role != RoleResource.GENERATED_ROLE && DatabaseDescriptor.getRoleManager().isExistingRole(role))
            throw new InvalidRequestException(String.format("%s already exists", role.getRoleName()));
    }

    public ResultMessage execute(ClientState state) throws RequestExecutionException, RequestValidationException
    {
        // not rejected in validate()
        if (ifNotExists && role != RoleResource.GENERATED_ROLE && DatabaseDescriptor.getRoleManager().isExistingRole(role))
            return null;

        RoleResource roleResource;
        if (opts.isGeneratedName())
        {
            Map<String, Object> options = (Map<String, Object>) opts.getOptions().get(IRoleManager.Option.OPTIONS);
            String generatedName = Guardrails.roleNamePolicy.generate(state, options);
            if (generatedName != null)
                roleResource = RoleResource.role(generatedName);
            else
                throw new InvalidRequestException("You have to enable role_name_policy and its generator_class_name property " +
                                                  "in cassandra.yaml to be able to generate role names.");
        }
        else
        {
            roleResource = role;
        }

        if (opts.isGeneratedPassword())
        {
            String generatedPassword = Guardrails.passwordPolicy.generate(state);
            if (generatedPassword != null)
                opts.setOption(IRoleManager.Option.PASSWORD, generatedPassword);
            else
                throw new InvalidRequestException("You have to enable password_policy and its generator_class_name property " +
                                                  "in cassandra.yaml to be able to generate passwords.");
        }

        opts.getPassword().ifPresent(password -> Guardrails.passwordPolicy.validate(password, state));

View on GitHub (pinned to 88fd0f6a0e)