{"record":{"id":"6a2192dc2e317ee1","repo":"apache/cassandra","slug":"jaas-login-configuration-missing-for-jmx-authentic","errorCode":null,"errorMessage":"JAAS login configuration missing for JMX authenticator setup","messagePattern":"JAAS login configuration missing for JMX authenticator setup","errorType":"exception","errorClass":"ConfigurationException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/auth/jmx/AuthenticationProxy.java","lineNumber":74,"sourceCode":"{\n    private static Logger logger = LoggerFactory.getLogger(AuthenticationProxy.class);\n\n    // Identifier of JAAS configuration to be used for subject authentication\n    private final String loginConfigName;\n\n    /**\n     * Creates an instance of <code>JMXPluggableAuthenticator</code>\n     * and initializes it with a {@link LoginContext}.\n     *\n     * @param loginConfigName name of the specifig JAAS login configuration to\n     *                        use when authenticating JMX connections\n     * @throws SecurityException if the authentication mechanism cannot be\n     *         initialized.\n     */\n    public AuthenticationProxy(String loginConfigName)\n    {\n        if (loginConfigName == null)\n            throw new ConfigurationException(\"JAAS login configuration missing for JMX authenticator setup\");\n\n        this.loginConfigName = loginConfigName;\n    }\n\n    /**\n     * Perform authentication of the client opening the {@code}MBeanServerConnection{@code}\n     *\n     * @param credentials optionally these credentials may be supplied by the JMX user.\n     *                    Out of the box, the JDK's {@code}RMIServerImpl{@code} is capable\n     *                    of supplying a two element String[], containing username and password.\n     *                    If present, these credentials will be made available to configured\n     *                    {@code}LoginModule{@code}s via {@code}JMXCallbackHandler{@code}.\n     *\n     * @return the authenticated subject containing any {@code}Principal{@code}s added by\n     *the {@code}LoginModule{@code}s\n     *\n     * @throws SecurityException if the server cannot authenticate the user\n     *         with the provided credentials.","sourceCodeStart":56,"sourceCodeEnd":92,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/auth/jmx/AuthenticationProxy.java#L56-L92","documentation":"AuthenticationProxy's constructor requires a JAAS login configuration name to initialize JMX authentication. Passing null (i.e. no login module configured) throws a ConfigurationException, because the JMX authenticator cannot be set up without a JAAS entry.","triggerScenarios":"Server startup with JMX authentication enabled but cassandra-env/jvm options or cassandra.yaml providing no JAAS login config name, so new AuthenticationProxy(null) is invoked.","commonSituations":"Enabling JMX authentication without creating/pointing to a JAAS config file (-Dcassandra.jmx.server... / JAVA_TOOL_OPTIONS missing -Djava.security.auth.login.config); typos in the config property name leaving it unset.","solutions":["Create a JAAS config file defining the login module (e.g. CassandraJMXAuthenticator entry).","Start Cassandra with -Djava.security.auth.login.config=/path/to/jaas.conf.","Ensure the property feeding loginConfigName (e.g. cassandra.jmx.authentication.login.config) is set in cassandra.yaml/env.","If JAAS auth is not desired, disable JMX authentication rather than leaving it half-configured."],"exampleFix":"// before (cassandra-env.sh)\n# JVM_OPTS=\"$JVM_OPTS -Djava.security.auth.login.config=/etc/cassandra/jaas.conf\"\n// after\nJVM_OPTS=\"$JVM_OPTS -Djava.security.auth.login.config=/etc/cassandra/jaas.conf\"","handlingStrategy":"validation","validationCode":"String loginConfig = System.getProperty(\"cassandra.jmx.server.login.config\");\nif (loginConfig == null || System.getProperty(\"java.security.auth.login.config\") == null)\n    throw new IllegalStateException(\"JAAS login config must be set before enabling JMX authentication\");","typeGuard":null,"tryCatchPattern":"try {\n    new AuthenticationProxy(loginConfigName);\n} catch (ConfigurationException e) {\n    log.error(\"JMX auth enabled but no JAAS login config provided: {}\", e.getMessage());\n}","preventionTips":["Create the JAAS file before enabling JMX authentication.","Set -Djava.security.auth.login.config in cassandra-env.sh.","Smoke-test JMX login after config changes."],"tags":["cassandra","jmx","jaas","configuration"],"backgroundTag":"missing-required-config","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}