{"record":{"id":"05c7aef034208726","repo":"apache/cassandra","slug":"you-have-to-enable-role-name-policy-and-its-genera","errorCode":null,"errorMessage":"You have to enable role_name_policy and its generator_class_name property in cassandra.yaml to be able to generate role names.","messagePattern":"You have to enable role_name_policy and its generator_class_name property in cassandra\\.yaml to be able to generate role names\\.","errorType":"validation","errorClass":"InvalidRequestException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/cql3/statements/CreateRoleStatement.java","lineNumber":114,"sourceCode":"        if (!ifNotExists && role != RoleResource.GENERATED_ROLE && DatabaseDescriptor.getRoleManager().isExistingRole(role))\n            throw new InvalidRequestException(String.format(\"%s already exists\", role.getRoleName()));\n    }\n\n    public ResultMessage execute(ClientState state) throws RequestExecutionException, RequestValidationException\n    {\n        // not rejected in validate()\n        if (ifNotExists && role != RoleResource.GENERATED_ROLE && DatabaseDescriptor.getRoleManager().isExistingRole(role))\n            return null;\n\n        RoleResource roleResource;\n        if (opts.isGeneratedName())\n        {\n            Map<String, Object> options = (Map<String, Object>) opts.getOptions().get(IRoleManager.Option.OPTIONS);\n            String generatedName = Guardrails.roleNamePolicy.generate(state, options);\n            if (generatedName != null)\n                roleResource = RoleResource.role(generatedName);\n            else\n                throw new InvalidRequestException(\"You have to enable role_name_policy and its generator_class_name property \" +\n                                                  \"in cassandra.yaml to be able to generate role names.\");\n        }\n        else\n        {\n            roleResource = role;\n        }\n\n        if (opts.isGeneratedPassword())\n        {\n            String generatedPassword = Guardrails.passwordPolicy.generate(state);\n            if (generatedPassword != null)\n                opts.setOption(IRoleManager.Option.PASSWORD, generatedPassword);\n            else\n                throw new InvalidRequestException(\"You have to enable password_policy and its generator_class_name property \" +\n                                                  \"in cassandra.yaml to be able to generate passwords.\");\n        }\n\n        opts.getPassword().ifPresent(password -> Guardrails.passwordPolicy.validate(password, state));","sourceCodeStart":96,"sourceCodeEnd":132,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/cql3/statements/CreateRoleStatement.java#L96-L132","documentation":"When CREATE ROLE is issued without an explicit role name (generated-role path), Cassandra asks Guardrails.roleNamePolicy to generate the name. If the role_name_policy guardrail (or its generator_class_name) is not configured in cassandra.yaml, generate() returns null and this InvalidRequestException is thrown.","triggerScenarios":"A client issues the generated-role form of CREATE ROLE (role == RoleResource.GENERATED_ROLE) while role_name_policy is disabled or lacks generator_class_name in cassandra.yaml, so roleNamePolicy.generate(state, options) yields null.","commonSituations":"Clusters upgraded where the new role_name_policy guardrail was never enabled; mis-edited cassandra.yaml omitting generator_class_name; applications adopting generated role names without coordinating server config.","solutions":["Enable role_name_policy in cassandra.yaml and set its generator_class_name to a valid IRoleNamePolicy implementation, then restart the node.","Alternatively, provide an explicit role name in the CREATE ROLE statement instead of relying on generation."],"exampleFix":"# before (cassandra.yaml)\n# role_name_policy not configured\n# after\nrole_name_policy:\n  enabled: true\n  generator_class_name: org.apache.cassandra.db.guardrails.CustomRoleNameGenerator","handlingStrategy":"validation","validationCode":"// ops check before using generated role names\n// verify in cassandra.yaml on every node:\n//   role_name_policy enabled with a valid generator_class_name\nassert yamlConfig.role_name_policy && yamlConfig.role_name_policy.generator_class_name != null;","typeGuard":null,"tryCatchPattern":"try { session.execute(generatedRoleCql); } catch (InvalidRequestException e) { if (e.getMessage().contains(\"role_name_policy\")) { /* enable policy in yaml or fall back to explicit name */ } else throw e; }","preventionTips":["Enable role_name_policy and generator_class_name in cassandra.yaml before adopting generated role names","Include guardrail config in cluster deployment smoke tests","Keep explicit role names as a fallback in application config"],"tags":["guardrails","config","roles"],"backgroundTag":"feature-not-enabled","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}