{"record":{"id":"948fb6195b177843","repo":"apache/cassandra","slug":"s-requires-s","errorCode":null,"errorMessage":"%s requires %s","messagePattern":"(.+?) requires (.+?)","errorType":"validation","errorClass":"ConfigurationException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/auth/AuthConfig.java","lineNumber":108,"sourceCode":"                                             authenticator.getClass().getName() + \" to enable authentication\", false);\n        }\n\n        DatabaseDescriptor.setAuthorizer(authorizer);\n\n        // default role initializer: bootstraps the first role on a cluster which has none yet. Instantiated\n        // before the role manager because the role manager depends on it (see IRoleManager#defaultRoleInitializer).\n\n        IDefaultRoleInitializer defaultRoleInitializer = authInstantiate(conf.default_role_initializer,\n                                                                         IDefaultRoleInitializer.class,\n                                                                         PasswordDefaultRoleInitializer.instance);\n        DatabaseDescriptor.setDefaultRoleInitializer(defaultRoleInitializer);\n\n        // role manager\n\n        IRoleManager roleManager = authInstantiate(conf.role_manager, IRoleManager.class, CassandraRoleManager.class);\n\n        if (authenticator instanceof PasswordAuthenticator && !(roleManager instanceof CassandraRoleManager))\n            throw new ConfigurationException(authenticator.getClass().getName() + \" requires \" + CassandraRoleManager.class.getName(), false);\n\n        validateDefaultRoleInitializerSupportsRoleManager(conf.default_role_initializer, defaultRoleInitializer, roleManager);\n\n        DatabaseDescriptor.setRoleManager(roleManager);\n\n        // authenticator\n\n        IInternodeAuthenticator internodeAuthenticator = authInstantiate(conf.internode_authenticator,\n                                                                         IInternodeAuthenticator.class,\n                                                                         AllowAllInternodeAuthenticator.class);\n        DatabaseDescriptor.setInternodeAuthenticator(internodeAuthenticator);\n\n        // network authorizer\n\n        INetworkAuthorizer networkAuthorizer = authInstantiate(conf.network_authorizer,\n                                                               INetworkAuthorizer.class,\n                                                               AllowAllNetworkAuthorizer.class);\n","sourceCodeStart":90,"sourceCodeEnd":126,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/auth/AuthConfig.java#L90-L126","documentation":"AuthConfig.applyAuth requires CassandraRoleManager when PasswordAuthenticator is configured, because PasswordAuthenticator stores credentials as internal role hashes managed by CassandraRoleManager. Using any other IRoleManager leaves the authenticator without its expected credential storage, so startup fails with a ConfigurationException of the form '<Authenticator> requires <CassandraRoleManager>'.","triggerScenarios":"Configuring authenticator: PasswordAuthenticator together with role_manager set to any IRoleManager other than CassandraRoleManager in cassandra.yaml.","commonSituations":"Operators using a custom/external role manager (e.g. LDAP-backed) while keeping PasswordAuthenticator; migrating role management without switching authenticators.","solutions":["Set role_manager: CassandraRoleManager in cassandra.yaml when using PasswordAuthenticator.","Or switch to an authenticator that does not require CassandraRoleManager (e.g. certificate-based authenticator).","Restart the node after aligning authenticator and role_manager settings."],"exampleFix":"// before (cassandra.yaml)\nauthenticator: PasswordAuthenticator\nrole_manager: MyLdapRoleManager\n// after\nauthenticator: PasswordAuthenticator\nrole_manager: CassandraRoleManager\n","handlingStrategy":"validation","validationCode":"if (\"PasswordAuthenticator\".equals(conf.authenticator) && !\"CassandraRoleManager\".equals(conf.role_manager))\n    throw new IllegalArgumentException(\"PasswordAuthenticator requires CassandraRoleManager\");","typeGuard":null,"tryCatchPattern":"try { startCassandra(); } catch (ConfigurationException e) { log.fatal(\"role_manager/authenticator mismatch: \" + e.getMessage()); }","preventionTips":["Keep role_manager: CassandraRoleManager whenever authenticator is PasswordAuthenticator.","Switch authenticators first when migrating to external role managers.","Test auth config changes on a staging node before production restart."],"tags":["auth","configuration","startup","role-manager"],"backgroundTag":"conflicting-config-options","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}