{"record":{"id":"5fc6d6eae33dc855","repo":"apache/cassandra","slug":"s-can-t-be-used-with-s","errorCode":null,"errorMessage":"%s can't be used with %s","messagePattern":"(.+?) can't be used with (.+?)","errorType":"validation","errorClass":"ConfigurationException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/auth/AuthConfig.java","lineNumber":129,"sourceCode":"\n        DatabaseDescriptor.setRoleManager(roleManager);\n\n        // authenticator\n\n        IInternodeAuthenticator internodeAuthenticator = authInstantiate(conf.internode_authenticator,\n                                                                         IInternodeAuthenticator.class,\n                                                                         AllowAllInternodeAuthenticator.class);\n        DatabaseDescriptor.setInternodeAuthenticator(internodeAuthenticator);\n\n        // network authorizer\n\n        INetworkAuthorizer networkAuthorizer = authInstantiate(conf.network_authorizer,\n                                                               INetworkAuthorizer.class,\n                                                               AllowAllNetworkAuthorizer.class);\n\n        if (networkAuthorizer.requireAuthorization() && !authenticator.requireAuthentication())\n        {\n            throw new ConfigurationException(conf.network_authorizer + \" can't be used with \" + conf.authenticator.class_name, false);\n        }\n\n        DatabaseDescriptor.setNetworkAuthorizer(networkAuthorizer);\n\n        // cidr authorizer\n\n        ICIDRAuthorizer cidrAuthorizer = authInstantiate(conf.cidr_authorizer,\n                                                         ICIDRAuthorizer.class,\n                                                         AllowAllCIDRAuthorizer.class);\n\n        if (cidrAuthorizer.requireAuthorization() && !authenticator.requireAuthentication())\n        {\n            throw new ConfigurationException(conf.cidr_authorizer + \" can't be used with \" + conf.authenticator, false);\n        }\n\n        DatabaseDescriptor.setCIDRAuthorizer(cidrAuthorizer);\n\n        // Validate at last to have authenticator, authorizer, role-manager and internode-auth setup","sourceCodeStart":111,"sourceCodeEnd":147,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/auth/AuthConfig.java#L111-L147","documentation":"During applyAuth, Cassandra rejects a configuration where the configured INetworkAuthorizer requires authorization but the authenticator does not require authentication. Network authorization (per-DC access control) needs authenticated subjects, so combining e.g. AllowAllAuthenticator with a real network authorizer fails startup with a ConfigurationException.","triggerScenarios":"Setting network_authorizer to a class whose requireAuthorization() returns true (e.g. CassandraNetworkAuthorizer) while authenticator (conf.authenticator.class_name) is AllowAllAuthenticator or otherwise non-authenticating.","commonSituations":"Enabling datacenter-level access control without first enabling authentication; partially applied security hardening configs.","solutions":["Set authenticator: PasswordAuthenticator (or another authenticating authenticator) in cassandra.yaml.","Or set network_authorizer: AllowAllNetworkAuthorizer if authentication is not wanted.","Restart the node after making the settings consistent."],"exampleFix":"// before (cassandra.yaml)\nauthenticator: AllowAllAuthenticator\nnetwork_authorizer: CassandraNetworkAuthorizer\n// after\nauthenticator: PasswordAuthenticator\nnetwork_authorizer: CassandraNetworkAuthorizer\n","handlingStrategy":"validation","validationCode":"if (!\"AllowAllNetworkAuthorizer\".equals(conf.network_authorizer) && \"AllowAllAuthenticator\".equals(conf.authenticator))\n    throw new IllegalArgumentException(\"network_authorizer requires an authenticating authenticator\");","typeGuard":null,"tryCatchPattern":"try { node.start(); } catch (ConfigurationException e) { log.fatal(\"network authorizer config invalid: \" + e.getMessage()); }","preventionTips":["Enable authentication before enabling CassandraNetworkAuthorizer.","Review the full auth section (authenticator, authorizer, network_authorizer, cidr_authorizer) as one unit.","Roll config changes through staging first."],"tags":["auth","configuration","startup","network-authorizer"],"backgroundTag":"conflicting-config-options","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}