{"record":{"id":"3f5e91ad9062b416","repo":"apache/cassandra","slug":"certificate-identity-not-authorized","errorCode":null,"errorMessage":"Certificate identity '{}' not authorized","messagePattern":"Certificate identity '(.+?)' not authorized","errorType":"exception","errorClass":"AuthenticationException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/auth/MutualTlsAuthenticator.java","lineNumber":230,"sourceCode":"            {\n                String message = \"Invalid or not supported certificate\";\n                nospamLogger.error(message);\n                throw new AuthenticationException(message);\n            }\n\n            String identity = certificateValidator.identity(clientCertificateChain);\n            if (StringUtils.isEmpty(identity))\n            {\n                String msg = \"Unable to extract client identity from certificate for authentication\";\n                nospamLogger.error(msg);\n                throw new AuthenticationException(msg);\n            }\n            String role = identityCache.get(identity);\n            if (role == null)\n            {\n                String msg = \"Certificate identity '{}' not authorized\";\n                nospamLogger.error(msg, identity);\n                throw new AuthenticationException(MessageFormatter.format(msg, identity).getMessage());\n            }\n\n            // Validates that the certificate validity period does not exceed the maximum certificate configured validity period\n            int minutesToCertificateExpiration = certificateValidityPeriodValidator.validate(clientCertificateChain);\n            int daysToCertificateExpiration = MutualTlsUtil.minutesToDays(minutesToCertificateExpiration);\n\n            if (certificateValidityWarnThreshold != null\n                && minutesToCertificateExpiration < certificateValidityWarnThreshold.toMinutes())\n            {\n                nospamLogger.warn(\"Certificate with identity '{}' will expire in {}\",\n                                  identity, MutualTlsUtil.toHumanReadableCertificateExpiration(minutesToCertificateExpiration));\n            }\n\n            // Report metrics on client certificate expiration\n            MutualTlsMetrics.instance.clientCertificateExpirationDays.update(daysToCertificateExpiration);\n\n            return new AuthenticatedUser(role, MTLS, Map.of(METADATA_IDENTITY_KEY, identity));\n        }","sourceCodeStart":212,"sourceCodeEnd":248,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/auth/MutualTlsAuthenticator.java#L212-L248","documentation":"AuthenticationException from getAuthenticatedUser: an identity was successfully extracted from the certificate, but no role in system_auth grants access for it (the identity-to-role lookup/authorization check failed). The identity itself is syntactically fine; it is simply not an authorized identity.","triggerScenarios":"Thrown at src/java/org/apache/cassandra/auth/MutualTlsAuthenticator.java:230 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Create a role matching the certificate identity or map the identity to an existing role","Verify the identity spelling/case used in the role mapping matches the extracted identity","If a role initializer is configured, check that it auto-creates roles for authorized identities correctly"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}