{"record":{"id":"07a7714edb911a2b","repo":"apache/cassandra","slug":"permissions-for-jmx-resource-contains-invalid-obje","errorCode":null,"errorMessage":"Permissions for JMX resource contains invalid ObjectName {}","messagePattern":"Permissions for JMX resource contains invalid ObjectName (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"src/java/org/apache/cassandra/auth/jmx/AuthorizationProxy.java","lineNumber":399,"sourceCode":"\n        // Iterate over the resources the permission has been granted on. Some of these may\n        // be patterns, so query the server to retrieve the full list of matching names and\n        // remove those from the target set. Once the target set is empty (i.e. all required\n        // matches have been satisfied), the requirement is met.\n        // If there are still unsatisfied targets after all the JMXResources have been processed,\n        // there are insufficient grants to permit the operation.\n        for (JMXResource resource : permittedResources)\n        {\n            try\n            {\n                Set<ObjectName> matchingNames = queryNames.apply(ObjectName.getInstance(resource.getObjectName()));\n                targetNames.removeAll(matchingNames);\n                if (targetNames.isEmpty())\n                    return true;\n            }\n            catch (MalformedObjectNameException e)\n            {\n                logger.warn(\"Permissions for JMX resource contains invalid ObjectName {}\", resource.getObjectName());\n            }\n        }\n\n        logger.trace(\"Subject does not have sufficient permissions on all MBeans matching the target pattern {}\", target);\n        return false;\n    }\n\n    /**\n     * Given a set of JMXResources upon which the Subject has been granted a particular permission,\n     * check whether any match the ObjectName representing the target of the method invocation.\n     * At this point, we are sure that whatever the required permission, the Subject has definitely\n     * been granted it against this set of JMXResources. The job of this method is only to verify\n     * that the target of the invocation is matched by a member of the set.\n     *\n     * @param target\n     * @param permittedResources\n     * @return true if at least one of the permitted resources matches the target; false otherwise\n     */","sourceCodeStart":381,"sourceCodeEnd":417,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/auth/jmx/AuthorizationProxy.java#L381-L417","documentation":"When authorizing a JMX operation via wildcard patterns, AuthorizationProxy.checkPattern builds an ObjectName from each permission resource's stored objectName string. If that string is malformed, ObjectName construction throws MalformedObjectNameException; Cassandra logs this warning, skips the resource, and denies (or continues checking other resources) rather than crashing.","triggerScenarios":"A JMX permission resource in the role manager (e.g. granted via GRANT PERMISSIONS ON JMX property-like ObjectName string) contains an ObjectName string that fails ObjectName.getInstance — bad quoting, missing domain, invalid characters in key values.","commonSituations":"Hand-written GRANT statements like GRANT EXECUTE ON JMX 'org.apache.cassandra:type=ThreadPools,path===' that contain invalid key/value syntax; unquoted wildcard or colon characters; editing permissions directly in system_auth; copying ObjectName patterns from logs with truncation.","solutions":["Fix the stored resource string: DROP/revoke the bad permission and re-grant with a valid ObjectName (validate with jconsole or `new ObjectName(str)`).","List the role's permissions (LIST ALL PERMISSIONS OF <role>) to find the offending JMX resource.","Quote special characters in ObjectName key values properly, e.g. org.apache.cassandra:type=ThreadPools,path=\\* quoting rules per javax.management.ObjectName docs.","Restrict provisioning tooling to validated ObjectName patterns."],"exampleFix":"// before (CQL)\nGRANT EXECUTE ON JMX 'org.apache.cassandra:type=*' TO operator; // invalid quoting in some variants\n// after\nGRANT EXECUTE ON JMX 'org.apache.cassandra:*)' -- no; use valid syntax:\nGRANT EXECUTE ON JMX 'org.apache.cassandra:*' TO operator;","handlingStrategy":"validation","validationCode":"// Validate an ObjectName string before granting (Java)\ntry { javax.management.ObjectName.getInstance(resourceString); }\ncatch (MalformedObjectNameException e) { throw new IllegalArgumentException(\"invalid JMX resource: \" + resourceString); }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always validate ObjectName strings (jconsole or ObjectName.getInstance) before GRANT ... ON JMX.","Follow javax.management.ObjectName quoting rules for special characters in values.","Use LIST ALL PERMISSIONS reviews after bulk permission imports.","Keep JMX resource grants copy-paste tested on a dev cluster first."],"tags":["jmx","objectname","permissions","authorization"],"backgroundTag":"invalid-objectname-pattern","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}