{"record":{"id":"b6d3ea0539e0541a","repo":"apache/cassandra","slug":"the-shortest-password-to-pass-the-warning-validato","errorCode":null,"errorMessage":"The shortest password to pass the warning validator for any %s characteristics out of %s is %s but you have set the %s to %s.","messagePattern":"The shortest password to pass the warning validator for any (.+?) characteristics out of (.+?) is (.+?) but you have set the (.+?) to (.+?)\\.","errorType":"validation","errorClass":"ConfigurationException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/db/guardrails/CassandraPasswordConfiguration.java","lineNumber":251,"sourceCode":"                                                    characteristicsWarn));\n\n        if (characteristicsFail > characteristicsWarn)\n            throw new ConfigurationException(format(\"%s can not be bigger than %s. You have set %s and %s respectively.\",\n                                                    CHARACTERISTIC_FAIL_KEY,\n                                                    CHARACTERISTIC_WARN_KEY,\n                                                    characteristicsFail,\n                                                    characteristicsWarn));\n\n        int[] minimumLengthsWarn = new int[]{ specialsWarn, digitsWarn,\n                                              upperCaseWarn, lowerCaseWarn };\n        Arrays.sort(minimumLengthsWarn);\n\n        int minimumLenghtOfWarnCharacteristics = 0;\n        for (int i = 0; i < characteristicsWarn; i++)\n            minimumLenghtOfWarnCharacteristics += minimumLengthsWarn[i];\n\n        if (minimumLenghtOfWarnCharacteristics > lengthWarn)\n            throw new ConfigurationException(format(\"The shortest password to pass the warning validator for any %s \" +\n                                                    \"characteristics out of %s is %s but you have set the %s to %s.\",\n                                                    characteristicsWarn,\n                                                    MAX_CHARACTERISTICS,\n                                                    minimumLenghtOfWarnCharacteristics,\n                                                    LENGTH_WARN_KEY,\n                                                    lengthWarn));\n\n        int[] minimumLengthsFail = new int[]{ specialsFail, digitsFail,\n                                              upperCaseFail, lowerCaseFail };\n        Arrays.sort(minimumLengthsFail);\n\n        int minimumLenghtOfFailCharacteristics = 0;\n        for (int i = 0; i < characteristicsFail; i++)\n            minimumLenghtOfFailCharacteristics += minimumLengthsFail[i];\n\n        if (minimumLenghtOfFailCharacteristics > lengthFail)\n            throw new ConfigurationException(format(\"The shortest password to pass the failing validator for any %s \" +\n                                                    \"characteristics out of %s is %s but you have set the %s to %s.\",","sourceCodeStart":233,"sourceCodeEnd":269,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/db/guardrails/CassandraPasswordConfiguration.java#L233-L269","documentation":"Thrown as a ConfigurationException during validateParameters when the per-characteristic minimum length thresholds are individually satisfiable but their combination is not: the sum of the shortest lengths of the 'characteristicsWarn' best characteristics exceeds the configured lengthWarn. In other words, no password of lengthWarn could ever pass the warning validator, so the config is rejected with a message stating the computed minimum password length.","triggerScenarios":"Configuring cassandra.yaml password guardrails with per-characteristic warn minimums (specials_warn, digits_warn, lower/upper_warn, etc.) whose k-smallest sum exceeds length_warn, e.g. requiring a total minimum length below what the individual characteristic minimums force.","commonSituations":"Raising length_warn downward or raising individual characteristic minimums upward independently, breaking the implicit invariant; admins tuning thresholds one at a time without rechecking the combination; copying partial configs from another cluster.","solutions":["Increase length_warn in cassandra.yaml to at least the minimum length reported in the error message","Decrease the per-characteristic warn minimums (specials_warn, digits_warn, etc.) so their k-smallest sum fits within length_warn","Recompute and test the combined configuration on a staging node before rollout"],"exampleFix":"// before\npassword_guardrails:\n  length_warn: 8\n  specials_warn: 3\n  digits_warn: 3\n// after\npassword_guardrails:\n  length_warn: 12\n  specials_warn: 3\n  digits_warn: 3","handlingStrategy":"validation","validationCode":"int[] mins = {specialsWarn, digitsWarn, lowerWarn, upperWarn};\nArrays.sort(mins);\nint shortest = 0;\nfor (int i = 0; i < characteristicsWarn; i++) shortest += mins[i];\nif (shortest > lengthWarn)\n    throw new ConfigurationException(\"Shortest passing warn password is \" + shortest + \" but length_warn is \" + lengthWarn);","typeGuard":null,"tryCatchPattern":"try { loadGuardrailConfig(); }\ncatch (ConfigurationException e) {\n    if (e.getMessage().contains(\"shortest password\")) { /* raise length_warn or lower characteristic minimums */ }\n    throw e;\n}","preventionTips":["Recompute the combined minimum whenever any characteristic minimum changes","Treat length_warn as a derived bound: set it after summing characteristic minimums","Validate the full guardrail matrix (warn and fail sides) in CI before rollout"],"tags":["configuration","guardrails","password"],"backgroundTag":"invalid-config-value","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}