{"record":{"id":"9422707743f3e440","repo":"apache/cassandra","slug":"required-key-s-is-missing","errorCode":null,"errorMessage":"Required key '%s' is missing","messagePattern":"Required key '(.+?)' is missing","errorType":"exception","errorClass":"AuthenticationException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/auth/PasswordAuthenticator.java","lineNumber":262,"sourceCode":"\n    public void validateConfiguration() throws ConfigurationException\n    {\n    }\n\n    public void setup()\n    {\n        String query = String.format(\"SELECT %s FROM %s.%s WHERE role = ?\",\n                                     SALTED_HASH,\n                                     SchemaConstants.AUTH_KEYSPACE_NAME,\n                                     AuthKeyspace.ROLES);\n        authenticateStatement = prepare(query);\n    }\n\n    public AuthenticatedUser legacyAuthenticate(Map<String, String> credentials) throws AuthenticationException\n    {\n        String username = credentials.get(USERNAME_KEY);\n        if (username == null)\n            throw new AuthenticationException(String.format(\"Required key '%s' is missing\", USERNAME_KEY));\n\n        String password = credentials.get(PASSWORD_KEY);\n        if (password == null)\n            throw new AuthenticationException(String.format(\"Required key '%s' is missing for provided username %s\", PASSWORD_KEY, username));\n\n        return authenticate(username, password);\n    }\n\n    public SaslNegotiator newSaslNegotiator(InetAddress clientAddress)\n    {\n        return new PlainTextSaslAuthenticator();\n    }\n\n    @Override\n    public Set<AuthenticationMode> getSupportedAuthenticationModes()\n    {\n        return AUTHENTICATION_MODES;\n    }","sourceCodeStart":244,"sourceCodeEnd":280,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/auth/PasswordAuthenticator.java#L244-L280","documentation":"Thrown by PasswordAuthenticator.legacyAuthenticate when the credentials map supplied (via the legacy Thrift-style authentication API) lacks the 'username' key. The authenticator requires both USERNAME_KEY and PASSWORD_KEY entries to perform authentication.","triggerScenarios":"Calling legacyAuthenticate(Map<String,String> credentials) with a map missing the 'username' key; client sending only a password, or using wrong key names in the credentials payload.","commonSituations":"Legacy client drivers or custom auth shims passing credentials under different key names (e.g. 'user' instead of 'username'); programmatic use of the authenticator API.","solutions":["Include the 'username' key in the credentials map","Verify exact key names: 'username' and 'password' (case-sensitive)","Use a modern driver with SASL/plain authentication instead of the legacy map API"],"exampleFix":"// before\nMap<String,String> creds = Map.of(\"password\", \"s3cret\");\n// after\nMap<String,String> creds = Map.of(\"username\", \"appuser\", \"password\", \"s3cret\");","handlingStrategy":"validation","validationCode":"// validate credentials map before calling\nif (creds.get(\"username\") == null) throw new IllegalArgumentException(\"username required\");\nauthenticator.legacyAuthenticate(creds);","typeGuard":null,"tryCatchPattern":"try { authenticator.legacyAuthenticate(creds); }\ncatch (AuthenticationException e) { /* report missing 'username' key to caller */ }","preventionTips":["Use the canonical key names 'username' and 'password' in credential maps","Validate map keys at the client boundary before invoking auth APIs"],"tags":["authentication","missing-argument","legacy-api"],"backgroundTag":"missing-required-argument","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}