{"record":{"id":"908f8754df357ffc","repo":"apache/cassandra","slug":"the-shortest-password-to-pass-the-failing-validato","errorCode":null,"errorMessage":"The shortest password to pass the failing validator for any %s characteristics out of %s is %s but you have set the %s to %s.","messagePattern":"The shortest password to pass the failing validator for any (.+?) characteristics out of (.+?) is (.+?) but you have set the (.+?) to (.+?)\\.","errorType":"validation","errorClass":"ConfigurationException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/db/guardrails/CassandraPasswordConfiguration.java","lineNumber":268,"sourceCode":"        if (minimumLenghtOfWarnCharacteristics > lengthWarn)\n            throw new ConfigurationException(format(\"The shortest password to pass the warning validator for any %s \" +\n                                                    \"characteristics out of %s is %s but you have set the %s to %s.\",\n                                                    characteristicsWarn,\n                                                    MAX_CHARACTERISTICS,\n                                                    minimumLenghtOfWarnCharacteristics,\n                                                    LENGTH_WARN_KEY,\n                                                    lengthWarn));\n\n        int[] minimumLengthsFail = new int[]{ specialsFail, digitsFail,\n                                              upperCaseFail, lowerCaseFail };\n        Arrays.sort(minimumLengthsFail);\n\n        int minimumLenghtOfFailCharacteristics = 0;\n        for (int i = 0; i < characteristicsFail; i++)\n            minimumLenghtOfFailCharacteristics += minimumLengthsFail[i];\n\n        if (minimumLenghtOfFailCharacteristics > lengthFail)\n            throw new ConfigurationException(format(\"The shortest password to pass the failing validator for any %s \" +\n                                                    \"characteristics out of %s is %s but you have set the %s to %s.\",\n                                                    characteristicsFail,\n                                                    MAX_CHARACTERISTICS,\n                                                    minimumLenghtOfFailCharacteristics,\n                                                    LENGTH_FAIL_KEY,\n                                                    lengthFail));\n\n        if (dictionary != null)\n        {\n            File dictionaryFile = new File(dictionary);\n            if (!dictionaryFile.exists())\n                throw new ConfigurationException(format(\"Dictionary file %s does not exist.\", dictionary));\n\n            if (!dictionaryFile.isReadable())\n                throw new ConfigurationException(format(\"Dictionary file %s is not readable.\", dictionary));\n        }\n    }\n","sourceCodeStart":250,"sourceCodeEnd":286,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/db/guardrails/CassandraPasswordConfiguration.java#L250-L286","documentation":"Cassandra's password guardrail configuration validates that the configured maximum failing-password length (cassandra.password_validator.length_fail) is at least as long as the sum of the minimum lengths of the shortest N failing characteristics (N = characteristics_fail). If the sum of the minimum per-characteristic lengths exceeds the configured length_fail, no valid password could ever be configured consistently, so a ConfigurationException is thrown at validation time.","triggerScenarios":"Calling validateParameters (directly or via CassandraPasswordConfiguration construction / guardrail config parsing) with characteristics_fail N and length_fail L where minLen[0]+...+minLen[N-1] > L, e.g. setting length_fail lower than the combined minimum lengths of the characteristics expected to fail.","commonSituations":"Operators tighten length_fail in cassandra.yaml (or via ALTER ... guardrail settings) without realizing the shortest-combination rule; copying config from a cluster with different characteristic minimums; typo'ing the length_fail value (e.g. dropping a digit).","solutions":["Increase length_fail so it is greater than or equal to the sum of the minimum lengths of the shortest characteristicsFail characteristics","Decrease characteristics_fail so fewer characteristics must fail and the summed minimum length fits under length_fail","Verify the configured values with the exact numbers printed in the exception (shortest valid sum vs. current length_fail)"],"exampleFix":"// before\ncassandra.yaml: length_fail: 8, characteristics_fail: 3 (min lengths sum = 12)\n// after\ncassandra.yaml: length_fail: 12, characteristics_fail: 3  # or reduce characteristics_fail to 2","handlingStrategy":"validation","validationCode":"int[] minLens = ...; // per-characteristic minimum lengths from config\nint sum = 0;\nfor (int i = 0; i < characteristicsFail; i++) sum += minLens[i];\nif (sum > lengthFail) throw new IllegalArgumentException(\"length_fail must be >= \" + sum);","typeGuard":null,"tryCatchPattern":"try {\n    applyGuardrailConfig(config);\n} catch (ConfigurationException e) {\n    if (e.getMessage().contains(\"The shortest password\")) {\n        logger.error(\"length_fail too small: {}\", e.getMessage());\n        // fall back to previous config\n    }\n}","preventionTips":["Compute the minimum-length sum for your characteristics before choosing length_fail","Keep length_fail >= sum of the shortest characteristicsFail minimums","Validate cassandra.yaml changes on a test node before rolling out"],"tags":["configuration","guardrails","password-policy","validation"],"backgroundTag":"invalid-config-value","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}