{"record":{"id":"f9c731574cb73cca","repo":"apache/cassandra","slug":"s-has-authorization-enabled-which-requires-s-to","errorCode":null,"errorMessage":"%s has authorization enabled which requires %s to enable authentication","messagePattern":"(.+?) has authorization enabled which requires (.+?) to enable authentication","errorType":"validation","errorClass":"ConfigurationException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/auth/AuthConfig.java","lineNumber":89,"sourceCode":"        if (!(authenticator instanceof PasswordAuthenticator || authenticator instanceof MutualTlsAuthenticator)\n            && (conf.credentials_update_interval != null\n                || conf.credentials_validity.toMilliseconds() != 2000\n                || conf.credentials_cache_max_entries != 1000))\n        {\n            logger.info(\"Configuration options credentials_update_interval, credentials_validity and \" +\n                        \"credentials_cache_max_entries may not be applicable for the configured authenticator ({})\",\n                        authenticator.getClass().getName());\n        }\n\n        DatabaseDescriptor.setAuthenticator(authenticator);\n\n        // authorizer\n\n        IAuthorizer authorizer = authInstantiate(conf.authorizer, IAuthorizer.class, AllowAllAuthorizer.class);\n\n        if (!authenticator.requireAuthentication() && authorizer.requireAuthorization())\n        {\n            throw new ConfigurationException(authorizer.getClass().getName() + \" has authorization enabled which requires \" +\n                                             authenticator.getClass().getName() + \" to enable authentication\", false);\n        }\n\n        DatabaseDescriptor.setAuthorizer(authorizer);\n\n        // default role initializer: bootstraps the first role on a cluster which has none yet. Instantiated\n        // before the role manager because the role manager depends on it (see IRoleManager#defaultRoleInitializer).\n\n        IDefaultRoleInitializer defaultRoleInitializer = authInstantiate(conf.default_role_initializer,\n                                                                         IDefaultRoleInitializer.class,\n                                                                         PasswordDefaultRoleInitializer.instance);\n        DatabaseDescriptor.setDefaultRoleInitializer(defaultRoleInitializer);\n\n        // role manager\n\n        IRoleManager roleManager = authInstantiate(conf.role_manager, IRoleManager.class, CassandraRoleManager.class);\n\n        if (authenticator instanceof PasswordAuthenticator && !(roleManager instanceof CassandraRoleManager))","sourceCodeStart":71,"sourceCodeEnd":107,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/auth/AuthConfig.java#L71-L107","documentation":"During startup configuration (AuthConfig.applyAuth), Cassandra validates that the configured IAuthorizer does not require authorization when the configured IAuthenticator does not require authentication. An authorizer like CassandraAuthorizer needs authenticated identities to grant permissions to, so combining e.g. AllowAllAuthenticator with CassandraAuthorizer is rejected with a ConfigurationException.","triggerScenarios":"Setting authenticator to AllowAllAuthenticator (or another non-authenticating authenticator) while authorizer is set to a class whose requireAuthorization() returns true (e.g. CassandraAuthorizer) in cassandra.yaml, then starting the node.","commonSituations":"Operators enabling role/permission-based security but forgetting to switch authenticator from AllowAllAuthenticator to PasswordAuthenticator; partial security hardening of a cluster.","solutions":["Set authenticator: PasswordAuthenticator (or another authenticator with requireAuthentication()==true) in cassandra.yaml.","Alternatively, set authorizer: AllowAllAuthorizer if you do not want authentication.","Restart the node after changing both settings consistently."],"exampleFix":"// before (cassandra.yaml)\nauthenticator: AllowAllAuthenticator\nauthorizer: CassandraAuthorizer\n// after\nauthenticator: PasswordAuthenticator\nauthorizer: CassandraAuthorizer\n","handlingStrategy":"validation","validationCode":"// pre-startup sanity check of cassandra.yaml semantics\nboolean authRequired = !\"AllowAllAuthenticator\".equals(conf.authenticator);\nboolean authzRequired = !\"AllowAllAuthorizer\".equals(conf.authorizer);\nif (authzRequired && !authRequired) throw new IllegalArgumentException(\"authorizer requires an authenticating authenticator\");","typeGuard":null,"tryCatchPattern":"try { DatabaseDescriptor.applyAll(); } catch (ConfigurationException e) { log.fatal(\"Auth config invalid: \" + e.getMessage()); System.exit(1); }","preventionTips":["Always change authenticator and authorizer together when enabling internal auth.","Validate cassandra.yaml with a config lint/staging startup before rolling to production.","Remember the canonical secure pair: PasswordAuthenticator + CassandraAuthorizer."],"tags":["auth","configuration","startup","cassandra-yaml"],"backgroundTag":"conflicting-config-options","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}