{"record":{"id":"95c515987561b2d5","repo":"apache/cassandra","slug":"s-requires-a-non-empty-s-parameter-95c515","errorCode":null,"errorMessage":"%s requires a non-empty %s parameter","messagePattern":"(.+?) requires a non-empty (.+?) parameter","errorType":"validation","errorClass":"ConfigurationException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/auth/PasswordDefaultRoleInitializer.java","lineNumber":110,"sourceCode":"\n    @Override\n    public void createDefaultRole()\n    {\n        QueryProcessor.process(createDefaultRoleQuery(), consistencyForRoleWrite(role));\n        logger.info(\"Created default superuser role '{}'\", role);\n    }\n\n    @Override\n    public String defaultRoleName()\n    {\n        return role;\n    }\n\n    @Override\n    public void validateConfiguration() throws ConfigurationException\n    {\n        if (Strings.isNullOrEmpty(role))\n            throw new ConfigurationException(String.format(\"%s requires a non-empty %s parameter\", getClass().getSimpleName(), ROLE));\n\n        boolean specifiedPassword = !Strings.isNullOrEmpty(password);\n        boolean specifiedPasswordHash = !Strings.isNullOrEmpty(passwordHash);\n\n        if (!specifiedPassword && !specifiedPasswordHash)\n            throw new ConfigurationException(String.format(\"There has to be one of %s, %s specified.\", PASSWORD, PASSWORD_HASH));\n        else if (specifiedPassword && specifiedPasswordHash)\n            throw new ConfigurationException(String.format(\"Only one of %s, %s can be specified.\", PASSWORD, PASSWORD_HASH));\n    }\n\n    @VisibleForTesting\n    public String createDefaultRoleQuery()\n    {\n        return String.format(\"INSERT INTO %s.%s (role, is_superuser, can_login, salted_hash) VALUES ('%s', true, true, '%s') USING TIMESTAMP 0\",\n                             SchemaConstants.AUTH_KEYSPACE_NAME,\n                             AuthKeyspace.ROLES,\n                             escapeCqlLiteral(role),\n                             escapeCqlLiteral(password == null ? passwordHash : hashpw(password)));","sourceCodeStart":92,"sourceCodeEnd":128,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/auth/PasswordDefaultRoleInitializer.java#L92-L128","documentation":"PasswordDefaultRoleInitializer is configured via cassandra.yaml (role_name/password/password_hash under authenticator options). validateConfiguration() runs at startup and rejects a configuration where the default role name is null or empty, since it cannot create an anonymous default superuser.","triggerScenarios":"Starting Cassandra with PasswordAuthenticator + PasswordDefaultRoleInitializer where role_name is missing, set to empty string, or whitespace-only.","commonSituations":"cassandra.yaml edited by hand with the role_name key removed or commented out; config templating tools rendering empty values; upgrading and merging yaml files incorrectly.","solutions":["Set a non-empty role_name under auth options in cassandra.yaml (e.g. role_name: cassandra)","If you don't need a default role, remove/replace the default_role_initializer option rather than leaving an empty role_name","Validate the yaml renders correctly (no templating blanks) before restart"],"exampleFix":"// before (cassandra.yaml)\nrole_name: \"\"\n// after\ncassandra:\n  authenticator: PasswordAuthenticator\n  role_manager: CassandraRoleManager\n  options:\n    role_name: cassandra\n    password: ChangeMeNow","handlingStrategy":"validation","validationCode":"String role = config.get(\"role_name\"); if (role == null || role.trim().isEmpty()) fail(\"role_name required by PasswordDefaultRoleInitializer\");","typeGuard":"boolean hasDefaultRoleName(Map<String,String> opts) { String r = opts.get(\"role_name\"); return r != null && !r.trim().isEmpty(); }","tryCatchPattern":"try { config.validate(); } catch (ConfigurationException e) { log.error(\"yaml auth config invalid\", e); System.exit(1); }","preventionTips":["Keep auth defaults in a reviewed config template","Run startup config validation in CI before deploys","Avoid empty-string values in templated yaml; omit keys entirely when unused"],"tags":["configuration","auth","startup"],"backgroundTag":"missing-required-config-field","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}