{"record":{"id":"47358c10791813e3","repo":"apache/cassandra","slug":"s-creates-a-role-with-no-password-which-s-canno","errorCode":null,"errorMessage":"%s creates a role with no password, which %s cannot authenticate (supported modes: %s). Configure an authenticator supporting mutual TLS, such as %s.","messagePattern":"(.+?) creates a role with no password, which (.+?) cannot authenticate \\(supported modes: (.+?)\\)\\. Configure an authenticator supporting mutual TLS, such as (.+?)\\.","errorType":"exception","errorClass":"ConfigurationException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/auth/MutualTlsDefaultRoleInitializer.java","lineNumber":116,"sourceCode":"\n    @Override\n    public void validateConfiguration() throws ConfigurationException\n    {\n        if (Strings.isNullOrEmpty(role))\n            throw new ConfigurationException(String.format(\"%s requires a non-empty '%s' parameter\",\n                                                           getClass().getSimpleName(), ROLE));\n\n        if (Strings.isNullOrEmpty(identity))\n            throw new ConfigurationException(String.format(\"%s requires a non-empty '%s' parameter\",\n                                                           getClass().getSimpleName(), IDENTITY));\n\n        // The role this creates has no password, so an authenticator which cannot authenticate by certificate\n        // would leave a freshly bootstrapped cluster with no way to log in at all.\n        IAuthenticator authenticator = DatabaseDescriptor.getAuthenticator();\n        Set<IAuthenticator.AuthenticationMode> modes = authenticator.getSupportedAuthenticationModes();\n        if (authenticator.requireAuthentication() && !modes.isEmpty() && !modes.contains(IAuthenticator.AuthenticationMode.MTLS))\n        {\n            throw new ConfigurationException(String.format(\"%s creates a role with no password, which %s cannot \" +\n                                                           \"authenticate (supported modes: %s). Configure an \" +\n                                                           \"authenticator supporting mutual TLS, such as %s.\",\n                                                           getClass().getSimpleName(),\n                                                           authenticator.getClass().getSimpleName(),\n                                                           modes,\n                                                           MutualTlsAuthenticator.class.getSimpleName()));\n        }\n    }\n}\n","sourceCodeStart":98,"sourceCodeEnd":126,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/auth/MutualTlsDefaultRoleInitializer.java#L98-L126","documentation":"ConfigurationException from validateConfiguration: the role initializer would auto-create a role with no password, but the configured IAuthenticator cannot authenticate password-less roles (only mutual-TLS-capable authenticators can). The message lists the configured authenticator and the supported modes — a cross-component config consistency check at startup.","triggerScenarios":"Thrown at src/java/org/apache/cassandra/auth/MutualTlsDefaultRoleInitializer.java:116 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Switch the authenticator to one supporting mutual TLS (e.g. MutualTlsAuthenticator) as the message suggests","Disable the default role initializer if automatic role creation is not needed","Manually create the role with appropriate credentials instead of relying on the initializer"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}