{"record":{"id":"dc7744d6ffbdfff5","repo":"apache/cassandra","slug":"it-is-not-possible-to-reconfigure-password-policy","errorCode":null,"errorMessage":"It is not possible to reconfigure password_policy guardrail because property 'password_policy_reconfiguration_enabled' is set to false.","messagePattern":"It is not possible to reconfigure password_policy guardrail because property 'password_policy_reconfiguration_enabled' is set to false\\.","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"src/java/org/apache/cassandra/db/guardrails/PasswordPolicyGuardrail.java","lineNumber":48,"sourceCode":"\npublic class PasswordPolicyGuardrail extends AbstractCustomGuardrail<String>\n{\n    private static final Logger logger = LoggerFactory.getLogger(PasswordPolicyGuardrail.class);\n\n    /**\n     * @param configSupplier configuration supplier of the custom guardrail\n     */\n    public PasswordPolicyGuardrail(Supplier<CustomGuardrailConfig> configSupplier)\n    {\n        super(\"password_policy\", null, configSupplier, true);\n    }\n\n    @Override\n    void reconfigure(@Nullable Map<String, Object> newConfig)\n    {\n        if (!DatabaseDescriptor.isPasswordPolicyReconfigurationEnabled())\n        {\n            logger.warn(\"It is not possible to reconfigure password_policy guardrail because \" +\n                        \"property 'password_policy_reconfiguration_enabled' is set to false.\");\n            return;\n        }\n\n        super.reconfigure(newConfig);\n    }\n\n    @Override\n    protected void throwException(String message, String redactedMessage)\n    {\n        throw new PasswordGuardrailException(message, redactedMessage);\n    }\n\n    public static class PasswordGuardrailException extends GuardrailViolatedException\n    {\n        public final String redactedMessage;\n\n        PasswordGuardrailException(String message, String redactedMessage)","sourceCodeStart":30,"sourceCodeEnd":66,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/db/guardrails/PasswordPolicyGuardrail.java#L30-L66","documentation":"PasswordPolicyGuardrail.reconfigure refuses to apply a new configuration at runtime when the DatabaseDescriptor property 'password_policy_reconfiguration_enabled' is false. This is a deliberate safety switch: the password policy is considered a security-critical setting that must not be changed via live updates (e.g. through guardrail JMX/config APIs). The reconfiguration request is logged and dropped.","triggerScenarios":"Calling reconfigure() on the password_policy guardrail (e.g. via JMX `setGuardrail` / config update) while cassandra.yaml or system property sets password_policy_reconfiguration_enabled: false.","commonSituations":"Operators attempting to tighten password rules on a running cluster without restart; automation that pushes guardrail config updates and silently expects password policy changes to stick.","solutions":["Set password_policy_reconfiguration_enabled: true in cassandra.yaml (or the equivalent system property) and restart if runtime changes are desired.","Otherwise, change the password policy directly in cassandra.yaml and perform a rolling restart.","Update automation to skip password_policy reconfiguration when the flag is disabled to avoid warn-log noise."],"exampleFix":"// before (cassandra.yaml)\npassword_policy_reconfiguration_enabled: false\n// after\npassword_policy_reconfiguration_enabled: true","handlingStrategy":"validation","validationCode":"if (!DatabaseDescriptor.isPasswordPolicyReconfigurationEnabled()) {\n    throw new UnsupportedOperationException(\"password_policy_reconfiguration_enabled is false; change cassandra.yaml and restart\");\n}","typeGuard":null,"tryCatchPattern":"try { guardrail.reconfigure(newConfig); }\ncatch (UnsupportedOperationException e) { /* fall back to yaml + restart flow */ }","preventionTips":["Exclude security-sensitive guardrails from automated runtime reconfiguration.","Check DatabaseDescriptor flags before calling reconfigure().","Change such settings via cassandra.yaml with a planned rolling restart."],"tags":["guardrails","security","configuration","runtime-reconfiguration"],"backgroundTag":"feature-not-enabled","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}