{"record":{"id":"c37bea21fe9e7917","repo":"apache/cassandra","slug":"can-not-add-identity-for-non-existent-role-s","errorCode":null,"errorMessage":"Can not add identity for non-existent role '%s'","messagePattern":"Can not add identity for non-existent role '(.+?)'","errorType":"validation","errorClass":"InvalidRequestException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/cql3/statements/AddIdentityStatement.java","lineNumber":68,"sourceCode":"    }\n\n    @Override\n    public void authorize(ClientState state)\n    {\n        checkPermission(state, Permission.CREATE, RoleResource.root());\n\n        if (!state.getUser().isSuper() && DatabaseDescriptor.getRoleManager().isSuper(RoleResource.role(role)))\n            throw new UnauthorizedException(\"Only superusers can bind identities to a role with superuser status\");\n    }\n\n    @Override\n    public void validate(ClientState state)\n    {\n        state.ensureNotAnonymous();\n\n        if (!DatabaseDescriptor.getRoleManager().isExistingRole(RoleResource.role(role)))\n        {\n            throw new InvalidRequestException(String.format(\"Can not add identity for non-existent role '%s'\", role));\n        }\n\n        if (!ifNotExists && DatabaseDescriptor.getRoleManager().isExistingIdentity(identity))\n            throw new InvalidRequestException(String.format(\"%s already exists\", identity));\n    }\n\n    @Override\n    public AuditLogContext getAuditLogContext()\n    {\n        return new AuditLogContext(AuditLogEntryType.CREATE_IDENTITY);\n    }\n\n    @Override\n    public ResultMessage execute(ClientState state) throws RequestExecutionException, RequestValidationException\n    {\n        if(!ifNotExists || !DatabaseDescriptor.getRoleManager().isExistingIdentity(identity))\n        {\n            DatabaseDescriptor.getRoleManager().addIdentity(identity, role);","sourceCodeStart":50,"sourceCodeEnd":86,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/cql3/statements/AddIdentityStatement.java#L50-L86","documentation":"A validation check in AddIdentityStatement.validate: the identity references a role name that does not exist in the configured RoleManager, so the statement is rejected with InvalidRequestException. Identities can only be created for existing roles.","triggerScenarios":"CREATE IDENTITY ... FOR role 'name' where isExistingRole(RoleResource.role(role)) is false — role never created, typo'd role name, or role exists in a different auth backend than the one configured via DatabaseDescriptor.","commonSituations":"Typo in role name; role was dropped before adding the identity; using CassandraRoles vs a custom RoleManager/alternator-ldap setup where the role lives elsewhere; case-sensitivity issues with quoted identifiers.","solutions":["Create the role first (CREATE ROLE name ...), then add the identity","Check the spelling/exact case of the role name","Confirm DatabaseDescriptor.getRoleManager() points to the backend that actually holds the role"],"exampleFix":"// before\nCREATE IDENTITY cert1 FOR 'app_role';  -- role does not exist\n// after\nCREATE ROLE app_role WITH LOGIN = true;\nCREATE IDENTITY cert1 FOR 'app_role';","handlingStrategy":"validation","validationCode":"// ensure role exists before creating identity\nResultSet rs = session.execute(\"SELECT role FROM system_auth.roles WHERE role = ?\", roleName);\nif (rs.all().isEmpty()) throw new IllegalArgumentException(\"Role '\" + roleName + \"' does not exist; create it first\");","typeGuard":null,"tryCatchPattern":"try { session.execute(createIdentity); } catch (InvalidRequestException e) { if (e.getMessage().contains(\"non-existent role\")) { /* create role then retry */ } else throw e; }","preventionTips":["Always CREATE ROLE before CREATE IDENTITY for it","Quote identifiers consistently to avoid case mismatches","Verify the configured RoleManager backend actually contains the role"],"tags":["auth","roles","validation"],"backgroundTag":"entity-not-found","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}