{"record":{"id":"3647c8fc444f538b","repo":"apache/cassandra","slug":"s-already-exists","errorCode":null,"errorMessage":"%s already exists","messagePattern":"(.+?) already exists","errorType":"validation","errorClass":"InvalidRequestException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/cql3/statements/AddIdentityStatement.java","lineNumber":72,"sourceCode":"    {\n        checkPermission(state, Permission.CREATE, RoleResource.root());\n\n        if (!state.getUser().isSuper() && DatabaseDescriptor.getRoleManager().isSuper(RoleResource.role(role)))\n            throw new UnauthorizedException(\"Only superusers can bind identities to a role with superuser status\");\n    }\n\n    @Override\n    public void validate(ClientState state)\n    {\n        state.ensureNotAnonymous();\n\n        if (!DatabaseDescriptor.getRoleManager().isExistingRole(RoleResource.role(role)))\n        {\n            throw new InvalidRequestException(String.format(\"Can not add identity for non-existent role '%s'\", role));\n        }\n\n        if (!ifNotExists && DatabaseDescriptor.getRoleManager().isExistingIdentity(identity))\n            throw new InvalidRequestException(String.format(\"%s already exists\", identity));\n    }\n\n    @Override\n    public AuditLogContext getAuditLogContext()\n    {\n        return new AuditLogContext(AuditLogEntryType.CREATE_IDENTITY);\n    }\n\n    @Override\n    public ResultMessage execute(ClientState state) throws RequestExecutionException, RequestValidationException\n    {\n        if(!ifNotExists || !DatabaseDescriptor.getRoleManager().isExistingIdentity(identity))\n        {\n            DatabaseDescriptor.getRoleManager().addIdentity(identity, role);\n        }\n        return null;\n    }\n}","sourceCodeStart":54,"sourceCodeEnd":90,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/cql3/statements/AddIdentityStatement.java#L54-L90","documentation":"A validation check in AddIdentityStatement.validate: when IF NOT EXISTS is not specified and the RoleManager already contains an identity with the same name, the statement fails with InvalidRequestException ('%s already exists' where %s is the identity). It protects against silently overwriting an existing identity.","triggerScenarios":"CREATE IDENTITY <name> ... (without IF NOT EXISTS) where isExistingIdentity(identity) is true — the identity was created previously by this or another operator.","commonSituations":"Re-running idempotent provisioning scripts; two operators creating the same named identity; CI pipelines replaying setup statements.","solutions":["Add IF NOT EXISTS: CREATE IDENTITY IF NOT EXISTS ...","Drop the existing identity first (DROP IDENTITY) if replacement is intended","Use a unique identity name"],"exampleFix":"// before\nCREATE IDENTITY cert1 FOR 'app_role';\n// after\nCREATE IDENTITY IF NOT EXISTS cert1 FOR 'app_role';","handlingStrategy":"validation","validationCode":"// check existence first, or use IF NOT EXISTS\nResultSet rs = session.execute(\"SELECT identity FROM system_auth.identities WHERE identity = ?\", identityName);\nboolean exists = !rs.all().isEmpty();\nString cql = exists ? null : \"CREATE IDENTITY \" + (idempotent ? \"IF NOT EXISTS \" : \"\") + identityName + \" ...\";","typeGuard":null,"tryCatchPattern":"try { session.execute(createIdentity); } catch (InvalidRequestException e) { if (e.getMessage().endsWith(\"already exists\")) { /* treat as success in idempotent provisioning */ } else throw e; }","preventionTips":["Use IF NOT EXISTS in all provisioning/CI scripts","Namespace identity names per environment to avoid collisions","Check existing identities (LIST IDENTITIES) before creating"],"tags":["auth","identity","duplicate"],"backgroundTag":"file-already-exists","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}