{"record":{"id":"840d2c7eb70707ae","repo":"apache/cassandra","slug":"it-was-not-possible-to-generate-a-valid-password-i","errorCode":null,"errorMessage":"It was not possible to generate a valid password in %s attempts. Check your configuration and try again.","messagePattern":"It was not possible to generate a valid password in (.+?) attempts\\. Check your configuration and try again\\.","errorType":"exception","errorClass":"ConfigurationException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/db/guardrails/CassandraPasswordGenerator.java","lineNumber":74,"sourceCode":"        passwordGenerator = new PasswordGenerator();\n    }\n\n    @Override\n    public String generate(ValueValidator<String> validator, Map<String, Object> options)\n    {\n        boolean dictionaryAware = validator instanceof PasswordDictionaryAware;\n\n        for (int i = 0; i < maxPasswordGenerationAttempts; i++)\n        {\n            String generatedPassword = passwordGenerator.generatePassword(configuration.lengthWarn, characterRules);\n            if (validator.shouldWarn(generatedPassword, false).isEmpty())\n            {\n                if (!dictionaryAware || ((PasswordDictionaryAware<?>) validator).foundInDictionary(generatedPassword).isValid())\n                    return generatedPassword;\n            }\n        }\n\n        throw new ConfigurationException(\"It was not possible to generate a valid password \" +\n                                         \"in \" + maxPasswordGenerationAttempts + \" attempts. \" +\n                                         \"Check your configuration and try again.\");\n    }\n\n    @Nonnull\n    @Override\n    public CustomGuardrailConfig getParameters()\n    {\n        return configuration.asCustomGuardrailConfig();\n    }\n\n    @Override\n    public void validateParameters() throws ConfigurationException\n    {\n        configuration.validateParameters();\n    }\n\n    protected List<CharacterRule> getCharacterGenerationRules(int upper, int lower, int digits, int special)","sourceCodeStart":56,"sourceCodeEnd":92,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/db/guardrails/CassandraPasswordGenerator.java#L56-L92","documentation":"The password generator tries up to maxPasswordGenerationAttempts times to randomly produce a password that passes the configured validator (including dictionary checks). If no generated password passes within that budget, it throws a ConfigurationException, indicating the validator constraints are too strict or contradictory relative to the generation strategy.","triggerScenarios":"Validator configured with requirements the generator's random construction rarely or never satisfies (e.g. very long minimum length combined with special-character or dictionary rules); a dictionary rule that rejects nearly all candidate passwords; an excessively low maxPasswordGenerationAttempts.","commonSituations":"Operators add a large dictionary file that rejects most candidates; strict length/characteristic minimums combined with default attempt limits; tests exercising testPasswordGenerationLength or password generation with a misconfigured validator.","solutions":["Relax the validator constraints (lower minimum lengths, broaden character set requirements) so random generation can succeed","Increase maxPasswordGenerationAttempts in the password generator configuration","Check the dictionary rule: if the dictionary rejects most strings, narrow the rule or regenerate passwords with more entropy","Generate the password manually and verify it with the validator's validation logic before setting it"],"exampleFix":"// before\nmaxPasswordGenerationAttempts = 100, min_length = 40 with strict characteristic rules\n// after\nIncrease attempts: set password_generation.attempts to 1000, or reduce min_length to 16","handlingStrategy":"retry","validationCode":"// Validate that a manually chosen sample password passes before relying on generation\nboolean sampleOk = validator.validate(samplePassword).isValid();\nif (!sampleOk) throw new IllegalStateException(\"Validator rejects even hand-crafted passwords; config too strict\");","typeGuard":null,"tryCatchPattern":"try {\n    String pw = generator.generate();\n} catch (ConfigurationException e) {\n    if (e.getMessage().contains(\"generate a valid password\")) {\n        // relax validator constraints or raise maxPasswordGenerationAttempts, then retry\n    }\n}","preventionTips":["Test generation with your exact validator config before rollout","Keep maxPasswordGenerationAttempts generously high (1000+) for strict validators","Audit dictionary rules for over-rejection of random strings"],"tags":["guardrails","password-policy","configuration","generation-failed"],"backgroundTag":"invalid-config-value","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}