{"record":{"id":"ea7d7ef03fec803a","repo":"apache/cassandra","slug":"it-is-not-possible-to-reconfigure-role-name-policy","errorCode":null,"errorMessage":"It is not possible to reconfigure role_name_policy guardrail because property 'role_name_policy_reconfiguration_enabled' is set to false.","messagePattern":"It is not possible to reconfigure role_name_policy guardrail because property 'role_name_policy_reconfiguration_enabled' is set to false\\.","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"src/java/org/apache/cassandra/db/guardrails/RoleNamePolicyGuardrail.java","lineNumber":48,"sourceCode":"\npublic class RoleNamePolicyGuardrail extends AbstractCustomGuardrail<String>\n{\n    private static final Logger logger = LoggerFactory.getLogger(RoleNamePolicyGuardrail.class);\n\n    /**\n     * @param configSupplier configuration supplier of the custom guardrail\n     */\n    public RoleNamePolicyGuardrail(Supplier<CustomGuardrailConfig> configSupplier)\n    {\n        super(\"role_name_policy\", null, configSupplier, true);\n    }\n\n    @Override\n    void reconfigure(@Nullable Map<String, Object> newConfig)\n    {\n        if (!DatabaseDescriptor.isRoleNamePolicyReconfigurationEnabled())\n        {\n            logger.warn(\"It is not possible to reconfigure role_name_policy guardrail because \" +\n                        \"property 'role_name_policy_reconfiguration_enabled' is set to false.\");\n            return;\n        }\n\n        super.reconfigure(newConfig);\n    }\n\n    @Override\n    protected void throwException(String message, String redactedMessage)\n    {\n        throw new RoleNamePolicyGuardrailException(message, redactedMessage);\n    }\n\n    public static class RoleNamePolicyGuardrailException extends GuardrailViolatedException\n    {\n        public final String redactedMessage;\n\n        RoleNamePolicyGuardrailException(String message, String redactedMessage)","sourceCodeStart":30,"sourceCodeEnd":66,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/db/guardrails/RoleNamePolicyGuardrail.java#L30-L66","documentation":"RoleNamePolicyGuardrail.reconfigure refuses live reconfiguration when the DatabaseDescriptor property 'role_name_policy_reconfiguration_enabled' is false. Like the password policy guardrail, role naming policy is treated as a security-sensitive setting that must not change at runtime; the request is logged and ignored.","triggerScenarios":"Invoking reconfigure() on the role_name_policy guardrail (JMX/config update of guardrails) while role_name_policy_reconfiguration_enabled is set to false in the node configuration.","commonSituations":"Centralized guardrail-management tooling pushing updates to all guardrails; operators trying to tighten role naming conventions (e.g. regex, prefixes) on a live cluster without a restart.","solutions":["Enable role_name_policy_reconfiguration_enabled in cassandra.yaml and restart to permit runtime changes.","Change the role name policy in cassandra.yaml and perform a rolling restart instead.","Exclude role_name_policy from automated runtime reconfiguration flows."],"exampleFix":"// before (cassandra.yaml)\nrole_name_policy_reconfiguration_enabled: false\n// after\nrole_name_policy_reconfiguration_enabled: true","handlingStrategy":"validation","validationCode":"if (!DatabaseDescriptor.isRoleNamePolicyReconfigurationEnabled()) {\n    throw new UnsupportedOperationException(\"role_name_policy_reconfiguration_enabled is false; update cassandra.yaml and restart\");\n}","typeGuard":null,"tryCatchPattern":"try { guardrail.reconfigure(newConfig); }\ncatch (UnsupportedOperationException e) { /* fall back to yaml + restart flow */ }","preventionTips":["Do not include role_name_policy in runtime config-push tooling unless the flag is enabled.","Plan role policy changes as restart-required operations."],"tags":["guardrails","security","configuration","runtime-reconfiguration"],"backgroundTag":"feature-not-enabled","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}