{"record":{"id":"6b00cc462e95e2bd","repo":"apache/cassandra","slug":"authentication-error","errorCode":null,"errorMessage":"Authentication error","messagePattern":"Authentication error","errorType":"exception","errorClass":"SecurityException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/auth/jmx/AuthenticationProxy.java","lineNumber":118,"sourceCode":"        try\n        {\n            LoginContext loginContext = new LoginContext(loginConfigName, callbackHandler);\n            loginContext.login();\n            final Subject subject = loginContext.getSubject();\n            if (!subject.isReadOnly())\n            {\n                AccessController.doPrivileged((PrivilegedAction<Void>) () -> {\n                    subject.setReadOnly();\n                    return null;\n                });\n            }\n\n            return subject;\n        }\n        catch (LoginException e)\n        {\n            logger.trace(\"Authentication exception\", e);\n            throw new SecurityException(\"Authentication error\", e);\n        }\n    }\n\n    /**\n     * This callback handler supplies the username and password (which was\n     * optionally supplied by the JMX user) to the JAAS login module performing\n     * the authentication, should it require them . No interactive user\n     * prompting is necessary because the credentials are already available to\n     * this class (via its enclosing class).\n     */\n    private static final class JMXCallbackHandler implements CallbackHandler\n    {\n        private char[] username;\n        private char[] password;\n        private JMXCallbackHandler(Object credentials)\n        {\n            // if username/password credentials were supplied, store them in\n            // the relevant variables to make them accessible to LoginModules","sourceCodeStart":100,"sourceCodeEnd":136,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/auth/jmx/AuthenticationProxy.java#L100-L136","documentation":"AuthenticationProxy.authenticate() performs a JAAS login for a JMX client. If the LoginContext throws a LoginException (bad username/password, unknown principal, login module failure), it is wrapped in a SecurityException with message 'Authentication error' and the original exception as the cause.","triggerScenarios":"A JMX client connects with wrong credentials, or the JAAS login module fails (user not found, backend user store unreachable), causing LoginContext.login() to throw LoginException.","commonSituations":"Typos in JMX username/password in jconsole/jmxterm; users not provisioned in the JAAS-backed user store; password file/role backend down so the login module cannot verify credentials.","solutions":["Check the cause LoginException in the stack trace / debug log for the real reason.","Verify the JMX username exists and the password is correct in the credential store.","Confirm the JAAS login module's backend (file, DB) is reachable and readable by the Cassandra process.","Reconnect with correct credentials via jconsole/jmxterm."],"exampleFix":"// before\nMap<String, String[]> env = new HashMap<>();\nenv.put(JMXConnector.CREDENTIALS, new String[]{\"admin\", \"wrongpass\"});\n// after (correct credentials)\nenv.put(JMXConnector.CREDENTIALS, new String[]{\"admin\", \"correct-password\"});","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try (JMXConnector conn = JMXConnectorFactory.connect(url, env)) {\n    // authenticated\n} catch (SecurityException e) {\n    Throwable cause = e.getCause();\n    if (cause instanceof LoginException) {\n        // bad credentials or user store unavailable; log cause and re-prompt\n    }\n}","preventionTips":["Verify JMX credentials with a script before interactive tools.","Keep the JAAS-backed user store reachable and readable.","Monitor debug logs for LoginException causes."],"tags":["cassandra","jmx","jaas","authentication"],"backgroundTag":"authentication-failed","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}