{"record":{"id":"3f560c6c3791c996","repo":"apache/cassandra","slug":"you-have-to-enable-password-policy-and-its-generat","errorCode":null,"errorMessage":"You have to enable password_policy and its generator_class_name property in cassandra.yaml to be able to generate passwords.","messagePattern":"You have to enable password_policy and its generator_class_name property in cassandra\\.yaml to be able to generate passwords\\.","errorType":"validation","errorClass":"InvalidRequestException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/cql3/statements/AlterRoleStatement.java","lineNumber":146,"sourceCode":"        else\n        {\n            // if not attempting to alter another role, ensure we have ALTER permissions on it\n            super.checkPermission(state, Permission.ALTER, role);\n        }\n    }\n\n    public ResultMessage execute(ClientState state) throws RequestValidationException, RequestExecutionException\n    {\n        if (ifExists && !DatabaseDescriptor.getRoleManager().isExistingRole(role))\n            return null;\n\n        if (opts.isGeneratedPassword())\n        {\n            String generatedPassword = Guardrails.passwordPolicy.generate(state, Map.of());\n            if (generatedPassword != null)\n                opts.setOption(IRoleManager.Option.PASSWORD, generatedPassword);\n            else\n                throw new InvalidRequestException(\"You have to enable password_policy and its generator_class_name property \" +\n                                                  \"in cassandra.yaml to be able to generate passwords.\");\n        }\n\n        if (opts.getPassword().isPresent())\n            Guardrails.passwordPolicy.validate(opts.getPassword().get(), state);\n\n        ResultMessage resultMessage = null;\n        if (!opts.isEmpty())\n            resultMessage = DatabaseDescriptor.getRoleManager().alterRoleWithResult(state.getUser(), role, opts);\n\n        if (dcPermissions != null)\n            DatabaseDescriptor.getNetworkAuthorizer().setRoleDatacenters(role, dcPermissions);\n\n        if (cidrPermissions != null)\n            DatabaseDescriptor.getCIDRAuthorizer().setCidrGroupsForRole(role, cidrPermissions);\n\n        return resultMessage;\n    }","sourceCodeStart":128,"sourceCodeEnd":164,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/cql3/statements/AlterRoleStatement.java#L128-L164","documentation":"ALTER ROLE ... WITH PASSWORD = <generated> (isGeneratedPassword) delegates password creation to Guardrails.passwordPolicy.generate(). This InvalidRequestException is thrown when the generator returns null, which happens when password_policy (and its generator_class_name) is not enabled in cassandra.yaml.","triggerScenarios":"Executing ALTER ROLE ... WITH PASSWORD = <generated> (or the generated-password CQL path) on a cluster whose cassandra.yaml lacks password_policy enabled with a configured generator_class_name, so the generator produces null.","commonSituations":"Operators using the generated-password feature (often via cqlsh or provisioning scripts) without enabling the password policy guardrail in the cluster config; config present on one node but the statement hits a node with default config.","solutions":["Enable password_policy in cassandra.yaml and set password_policy.generator_class_name to a valid generator implementation, then restart the node","Provide an explicit password instead of the generated form: ALTER ROLE x WITH PASSWORD = 'secret'","Verify config was rolled out to the node the client is connected to"],"exampleFix":"// before (cassandra.yaml)\n# password_policy not configured\n// after (cassandra.yaml)\npassword_policy:\n  enabled: true\n  generator_class_name: org.apache.cassandra.auth.GeneratePasswordHashingPolicy # example implementation","handlingStrategy":"validation","validationCode":"// check cassandra.yaml before using generated passwords\n// password_policy:\n//   enabled: true\n//   generator_class_name: <implementation>\nboolean enabled = org.apache.cassandra.config.DatabaseDescriptor.getRawConfig().password_policy != null\n                  && org.apache.cassandra.config.DatabaseDescriptor.getRawConfig().password_policy.enabled;","typeGuard":null,"tryCatchPattern":"try { session.execute(\"ALTER ROLE r WITH PASSWORD = <generated>\"); }\ncatch (InvalidRequestException e) {\n    if (e.getMessage().contains(\"password_policy\")) { /* fall back to explicit password or fix config */ }\n}","preventionTips":["Enable password_policy with a generator_class_name in cassandra.yaml on all nodes before using generated passwords","Fall back to explicit passwords when the policy is not enabled"],"tags":["cql","configuration","passwords"],"backgroundTag":"missing-required-config-field","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}