{"record":{"id":"14fbd31e84e98521","repo":"apache/cassandra","slug":"authentication-id-must-not-be-null","errorCode":null,"errorMessage":"Authentication ID must not be null","messagePattern":"Authentication ID must not be null","errorType":"exception","errorClass":"AuthenticationException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/auth/PasswordAuthenticator.java","lineNumber":355,"sourceCode":"            for (int i = bytes.length - 1; i >= 0; i--)\n            {\n                if (bytes[i] == NUL)\n                {\n                    if (pass == null)\n                        pass = Arrays.copyOfRange(bytes, i + 1, end);\n                    else if (user == null)\n                        user = Arrays.copyOfRange(bytes, i + 1, end);\n                    else\n                        throw new AuthenticationException(\"Credential format error: username or password is empty or contains NUL(\\\\0) character\");\n\n                    end = i;\n                }\n            }\n\n            if (pass == null || pass.length == 0)\n                throw new AuthenticationException(\"Password must not be null\");\n            if (user == null || user.length == 0)\n                throw new AuthenticationException(\"Authentication ID must not be null\");\n\n            username = new String(user, StandardCharsets.UTF_8);\n            password = new String(pass, StandardCharsets.UTF_8);\n        }\n    }\n\n    public static class CredentialsCache extends AuthCache<String, String> implements CredentialsCacheMBean\n    {\n        private CredentialsCache(PasswordAuthenticator authenticator)\n        {\n            super(CACHE_NAME,\n                  DatabaseDescriptor::setCredentialsValidity,\n                  DatabaseDescriptor::getCredentialsValidity,\n                  DatabaseDescriptor::setCredentialsUpdateInterval,\n                  DatabaseDescriptor::getCredentialsUpdateInterval,\n                  DatabaseDescriptor::setCredentialsCacheMaxEntries,\n                  DatabaseDescriptor::getCredentialsCacheMaxEntries,\n                  DatabaseDescriptor::setCredentialsCacheActiveUpdate,","sourceCodeStart":337,"sourceCodeEnd":373,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/auth/PasswordAuthenticator.java#L337-L373","documentation":"decodeCredentials() validates that the second NUL-delimited segment (the authentication ID, i.e. username/role) is present and non-empty. An empty authcid cannot identify a role, so AuthenticationException is thrown.","triggerScenarios":"AuthResponse token shaped like \"\\0password\" or \"\\0\\0password\" where the username segment between the first and second NUL is missing or empty.","commonSituations":"Scripts sending only a password; misconfigured drivers with empty username; users running cqlsh without -u and no default login set.","solutions":["Provide a non-empty username (role name) in the SASL PLAIN token as the second NUL-separated segment","Set the credentials in the client (cqlsh -u user -p pass, driver AuthProvider, or environment variables used by tooling)","Check for string-building bugs that drop the username segment"],"exampleFix":"// before\nString token = \"\\0\\0\" + pass; // empty authcid\n// after\nString token = \"\" /*authzid*/ + \"\\0\" + role + \"\\0\" + pass;","handlingStrategy":"validation","validationCode":"if (user == null || user.isEmpty()) throw new IllegalArgumentException(\"username/role required for SASL PLAIN\");","typeGuard":"boolean hasAuthcid(String[] segments) { return segments.length >= 2 && segments[1] != null && !segments[1].isEmpty(); }","tryCatchPattern":"try { authenticate(user, pass); } catch (AuthenticationException e) { if (e.getMessage().contains(\"Authentication ID\")) fixUsernameConfig(); }","preventionTips":["Configure username explicitly in cqlsh (-u) or driver AuthProvider","Reject empty usernames at config load time","Check scripts for variables that interpolate to empty strings"],"tags":["authentication","sasl","missing-credentials"],"backgroundTag":"missing-credentials","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}