{"record":{"id":"f00bcf92dcc80d1d","repo":"apache/cassandra","slug":"unable-to-perform-authentication","errorCode":null,"errorMessage":"Unable to perform authentication: ","messagePattern":"Unable to perform authentication: ","errorType":"exception","errorClass":"AuthenticationException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/auth/PasswordAuthenticator.java","lineNumber":229,"sourceCode":"\n            ResultMessage.Rows rows = select(authenticateStatement, options);\n\n            // If either a non-existent role name was supplied, or no credentials\n            // were found for that role, we don't want to cache the result so we\n            // return a sentinel value. On receiving the sentinel, the caller can\n            // invalidate the cache and throw an appropriate exception.\n            if (rows.result.isEmpty())\n                return NO_SUCH_CREDENTIAL;\n\n            UntypedResultSet result = UntypedResultSet.create(rows.result);\n            if (!result.one().has(SALTED_HASH))\n                return NO_SUCH_CREDENTIAL;\n\n            return result.one().getString(SALTED_HASH);\n        }\n        catch (RequestExecutionException e)\n        {\n            throw new AuthenticationException(\"Unable to perform authentication: \" + e.getMessage(), e);\n        }\n    }\n\n    @VisibleForTesting\n    ResultMessage.Rows select(SelectStatement statement, QueryOptions options)\n    {\n        return statement.execute(QueryState.forInternalCalls(), options, Dispatcher.RequestTime.forImmediateExecution());\n    }\n\n    public Set<DataResource> protectedResources()\n    {\n        // Also protected by CassandraRoleManager, but the duplication doesn't hurt and is more explicit\n        return Set.of(DataResource.table(SchemaConstants.AUTH_KEYSPACE_NAME, AuthKeyspace.ROLES));\n    }\n\n    public void validateConfiguration() throws ConfigurationException\n    {\n    }","sourceCodeStart":211,"sourceCodeEnd":247,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/auth/PasswordAuthenticator.java#L211-L247","documentation":"Wraps a RequestExecutionException from querying the salted hash in system_auth.roles as an AuthenticationException. This is an infrastructure-level failure (query timeout, unavailability, schema mismatch) rather than wrong credentials — authentication could not be performed at all.","triggerScenarios":"SELECT on system_auth.roles fails while queryHashedPassword executes: coordinator timeout, insufficient live replicas for system_auth's replication factor, node down, or schema disagreement.","commonSituations":"system_auth under-replicated with a dead node; heavy load causing read timeouts on the roles query; running repair/replacement during authentication.","solutions":["Check node health and logs for the underlying RequestExecutionException","Ensure system_auth is replicated to at least RF nodes that are all up (nodetool repair system_auth)","Retry authentication after the cluster is healthy","Increase read timeouts if consistently timing out under load"],"exampleFix":"// before: auth fails while node is down\n$ nodetool status\n// after: repair system_auth and retry\n$ nodetool repair system_auth\n$ cqlsh -u appuser -p s3cret","handlingStrategy":"retry","validationCode":"// check cluster health before auth-dependent operations\nnodetool status  # ensure all system_auth replicas are up","typeGuard":null,"tryCatchPattern":"try { session = cluster.connect(); }\ncatch (AuthenticationException e) {\n    if (e.getMessage().startsWith(\"Unable to perform authentication\")) retryWithBackoff();\n}","preventionTips":["Run nodetool repair system_auth regularly","Give system_auth a replication factor matching the number of datacenters/replicas","Do not take all system_auth replica nodes down simultaneously"],"tags":["authentication","database-query","system-auth","availability"],"backgroundTag":"database-query-failed","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}