{"record":{"id":"404f12f7ce3e0854","repo":"apache/cassandra","slug":"identity-s-doesn-t-exist","errorCode":null,"errorMessage":"identity '%s' doesn't exist","messagePattern":"identity '(.+?)' doesn't exist","errorType":"validation","errorClass":"InvalidRequestException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/cql3/statements/DropIdentityStatement.java","lineNumber":82,"sourceCode":"            if (!state.getUser().isSuper())\n            {\n                // If the current user is a regular user and the target role is an admin role\n                // we disallow the operation. Only a superuser can remove an identity bound to\n                // a role with superuser status\n                if (Roles.hasSuperuserStatus(RoleResource.role(roleForIdentity)))\n                    throw new UnauthorizedException(\"Only superusers can remove identity bindings from a role with superuser status\");\n            }\n        }\n    }\n\n    @Override\n    public void validate(ClientState state)\n    {\n        state.ensureNotAnonymous();\n\n        if (!ifExists && !DatabaseDescriptor.getRoleManager().isExistingIdentity(identity))\n        {\n            throw new InvalidRequestException(String.format(\"identity '%s' doesn't exist\", identity));\n        }\n    }\n\n    @Override\n    public AuditLogContext getAuditLogContext()\n    {\n        return new AuditLogContext(AuditLogEntryType.DROP_IDENTITY);\n    }\n\n    @Override\n    public ResultMessage execute(ClientState state) throws RequestExecutionException, RequestValidationException\n    {\n        // not rejected in validate()\n        if(!ifExists || DatabaseDescriptor.getRoleManager().isExistingIdentity(identity))\n        {\n            DatabaseDescriptor.getRoleManager().dropIdentity(identity);\n        }\n        return null;","sourceCodeStart":64,"sourceCodeEnd":100,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/cql3/statements/DropIdentityStatement.java#L64-L100","documentation":"DropIdentityStatement.validate verifies the identity exists via DatabaseDescriptor.getRoleManager().isExistingIdentity(identity) and throws InvalidRequestException when it does not, unless IF EXISTS was specified. Anonymous callers are rejected earlier by ensureNotAnonymous to avoid existence probing.","triggerScenarios":"Executing DROP IDENTITY '<value>' where no identity with that exact value is registered in the role manager and IF EXISTS is absent.","commonSituations":"Certificate/identity rotation scripts referencing an identity already dropped or never provisioned; case/format mismatches (e.g., DN string differing in spacing or case); re-running cleanup against a fresh cluster.","solutions":["Use DROP IDENTITY IF EXISTS '<identity>' for idempotent cleanup.","List existing identities first (e.g., via system_auth/identity queries or role-manager tooling) and match the exact string.","Normalize the identity string (Distinguished Name formatting, whitespace, case) before issuing the drop."],"exampleFix":"// before\nDROP IDENTITY 'CN=svc, OU=sec';\n// after\nDROP IDENTITY IF EXISTS 'CN=svc, OU=sec';","handlingStrategy":"validation","validationCode":"// make idempotent at the CQL level\nconst stmt = `DROP IDENTITY IF EXISTS '${identity}'`;","typeGuard":null,"tryCatchPattern":"try { session.execute(cql); } catch (InvalidRequestException e) { if (e.getMessage().contains(\"doesn't exist\")) { /* treat as success for idempotent cleanup */ } else throw e; }","preventionTips":["Always use IF EXISTS for identity cleanup scripts","Match identity strings exactly (DN formatting, case, whitespace)","Verify identities exist before issuing drops when IF EXISTS is unavailable"],"tags":["cql","identity","not-found"],"backgroundTag":"resource-not-found","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}