{"record":{"id":"0e0e96c5c6c20ae1","repo":"apache/cassandra","slug":"provided-username-s-and-or-password-are-incorrect","errorCode":null,"errorMessage":"Provided username %s and/or password are incorrect","messagePattern":"Provided username (.+?) and/or password are incorrect","errorType":"exception","errorClass":"AuthenticationException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/auth/PasswordAuthenticator.java","lineNumber":196,"sourceCode":"\n        // intentional use of object equality\n        if (hash == NO_SUCH_CREDENTIAL)\n        {\n            // The cache was unable to load credentials via queryHashedPassword, probably because the supplied\n            // rolename doesn't exist. If caching is enabled we will have now cached the sentinel value for that key\n            // so we should invalidate it otherwise the cache will continue to serve that until it expires which\n            // will be a problem if the role is added in the meantime.\n            //\n            // We can't just throw the AuthenticationException directly from queryHashedPassword for a similar reason:\n            // if an existing role is dropped and active updates are enabled for the cache, the refresh in\n            // CacheRefresher::run will log and swallow the exception and keep serving the stale credentials until they\n            // eventually expire.\n            //\n            // So whenever we encounter the sentinal value, here and also in CacheRefresher (if active updates are\n            // enabled), we manually expunge the key from the cache. If caching is not enabled, AuthCache::invalidate\n            // is a safe no-op.\n            cache.invalidateCredentials(username);\n            throw new AuthenticationException(String.format(\"Provided username %s and/or password are incorrect\", username));\n        }\n\n        if (!checkpw(password, hash))\n            throw new AuthenticationException(String.format(\"Provided username %s and/or password are incorrect\", username));\n\n        return new AuthenticatedUser(username, AuthenticationMode.PASSWORD);\n    }\n\n    private String queryHashedPassword(String username)\n    {\n        try\n        {\n            QueryOptions options = QueryOptions.forInternalCalls(consistencyForRoleRead(username),\n                    Lists.newArrayList(ByteBufferUtil.bytes(username)));\n\n            ResultMessage.Rows rows = select(authenticateStatement, options);\n\n            // If either a non-existent role name was supplied, or no credentials","sourceCodeStart":178,"sourceCodeEnd":214,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/auth/PasswordAuthenticator.java#L178-L214","documentation":"Thrown as an AuthenticationException when PasswordAuthenticator.authenticate(username, password) looks up the user and finds NO_SUCH_CREDENTIAL — the username does not exist in system_auth.roles. The cached (sentinel) entry is expunged and the generic incorrect-username-or-password message is raised to avoid leaking which factor was wrong.","triggerScenarios":"Login attempt with a username that has no row in system_auth.roles; roles dropped or system_auth not repaired after node loss; wrong keyspace/replication making the roles table unreadable.","commonSituations":"Typo in username on connection strings; user deleted while applications still use the credentials; new cluster where the default superuser was never altered and the role renamed.","solutions":["Verify the role exists: SELECT role, can_login FROM system_auth.roles;","Create the role if missing: CREATE ROLE <user> WITH LOGIN = true AND PASSWORD = '<pw>';","Check system_auth replication/consistency if the role exists on other nodes","Fix the username in the client's connection configuration"],"exampleFix":"// before (client)\nuser = 'appuser'\n// after\nCREATE ROLE appuser WITH LOGIN = true AND PASSWORD = 's3cret';","handlingStrategy":"try-catch","validationCode":"// verify the role exists before attempting login\nSELECT role, can_login FROM system_auth.roles WHERE role = 'appuser';","typeGuard":null,"tryCatchPattern":"try { session = cluster.connect(); }\ncatch (AuthenticationException e) {\n    if (e.getMessage().contains(\"Provided username\")) { /* create/repair the role or fix username */ }\n}","preventionTips":["Provision roles via IaC before deploying applications that use them","Monitor system_auth consistency across the cluster","Use one secrets-management source for usernames to avoid typos"],"tags":["authentication","credentials","password-authenticator"],"backgroundTag":"authentication-required","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}