{"record":{"id":"00552f63f99b225a","repo":"t8y2/dbx","slug":"cassandrajavaclient-in-s-does-not-configure-krb5l","errorCode":null,"errorMessage":"CassandraJavaClient in %s does not configure Krb5LoginModule","messagePattern":"CassandraJavaClient in (.+?) does not configure Krb5LoginModule","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/cassandra-go/kerberos.go","lineNumber":468,"sourceCode":"\nfunc (config *kerberosConfig) applyKerberosConfigEnvironment() {\n\tif config.configPath == \"\" {\n\t\tconfig.configPath = os.Getenv(\"KRB5_CONFIG\")\n\t}\n}\n\nfunc (config *kerberosConfig) applyJAASConfig(path string) error {\n\tcontents, err := os.ReadFile(path)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"read Cassandra JAAS config %s: %w\", path, err)\n\t}\n\tblock := jaasBlockPattern.FindSubmatch(contents)\n\tif len(block) != 2 {\n\t\treturn fmt.Errorf(\"Cassandra JAAS config %s does not contain CassandraJavaClient\", path)\n\t}\n\tmodule := jaasModulePattern.FindSubmatch(block[1])\n\tif len(module) != 2 {\n\t\treturn fmt.Errorf(\"CassandraJavaClient in %s does not configure Krb5LoginModule\", path)\n\t}\n\toptions := map[string]string{}\n\tfor _, match := range jaasOptionPattern.FindAllSubmatch(module[1], -1) {\n\t\tvalue := firstNonEmpty(string(match[2]), string(match[3]), string(match[4]))\n\t\toptions[strings.ToLower(string(match[1]))] = value\n\t}\n\tif config.principal == \"\" {\n\t\tconfig.principal = options[\"principal\"]\n\t}\n\tif config.keytabPath == \"\" {\n\t\tconfig.keytabPath = options[\"keytab\"]\n\t}\n\tif config.ccachePath == \"\" {\n\t\tconfig.ccachePath = options[\"ticketcache\"]\n\t}\n\tif value, ok := options[\"usekeytab\"]; ok {\n\t\tconfig.useKeytab, err = strconv.ParseBool(value)\n\t\tif err != nil {","sourceCodeStart":450,"sourceCodeEnd":486,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/cassandra-go/kerberos.go#L450-L486","documentation":"applyJAASConfig parses a JAAS login config file and expects a `CassandraJavaClient { com.sun.security.auth.module.Krb5LoginModule ... };` block. The block was found, but the regex for the Krb5LoginModule entry (jaasModulePattern) matched nothing inside it, meaning the block does not actually configure a Kerberos login module. The library refuses to guess credentials from a JAAS block without a Krb5LoginModule.","triggerScenarios":"Calling the client's finalize path with a JAAS config whose CassandraJavaClient block contains no `com.sun.security.auth.module.Krb5LoginModule required ...;` entry — e.g. the block is empty, uses a different/misspelled module class, or only uses another LoginModule.","commonSituations":"Reusing a JAAS file from a non-Kerberos Cassandra setup; copying a Java example that used a different login module; hand-editing the JAAS file and deleting the module line while keeping the block wrapper; trailing comment or unusual whitespace/formatting inside the block that the parser does not recognize.","solutions":["Add a `com.sun.security.auth.module.Krb5LoginModule required ...;` entry inside the CassandraJavaClient block of the JAAS file.","Check the module class name spelling exactly (com.sun.security.auth.module.Krb5LoginModule) and that it ends with a semicolon.","Simplify the block formatting to the standard JAAS layout (no odd comments/nested braces) and retry.","If Kerberos is not needed, remove the JAAS config path (java.security.auth.login.config / jaas config option) instead of pointing at a non-Kerberos file."],"exampleFix":"// before (jaas.conf)\nCassandraJavaClient {\n    other.Module required;\n};\n// after\nCassandraJavaClient {\n    com.sun.security.auth.module.Krb5LoginModule required\n        useKeyTab=true\n        keyTab=\"/etc/security/keytabs/cassandra.keytab\"\n        principal=\"cassandra/_HOST@EXAMPLE.COM\";\n};","handlingStrategy":"validation","validationCode":"func validateJAAS(path string) error {\n\tb, err := os.ReadFile(path)\n\tif err != nil { return err }\n\tblock := regexp.MustCompile(`(?is)CassandraJavaClient\\s*\\{(.*?)\\}`).FindSubmatch(b)\n\tif block == nil { return fmt.Errorf(\"no CassandraJavaClient block\") }\n\tif !regexp.MustCompile(`(?i)Krb5LoginModule`).Match(block[1]) {\n\t\treturn fmt.Errorf(\"CassandraJavaClient block lacks Krb5LoginModule\")\n\t}\n\treturn nil\n}","typeGuard":"func hasKrb5Module(jaas string) bool {\n\treturn strings.Contains(strings.ToLower(jaas), \"krb5loginmodule\")\n}","tryCatchPattern":"if err := client.Finalize(); err != nil {\n\tif strings.Contains(err.Error(), \"does not configure Krb5LoginModule\") {\n\t\tlog.Fatalf(\"JAAS config %s needs com.sun.security.auth.module.Krb5LoginModule\", jaasPath)\n\t}\n\treturn err\n}","preventionTips":["Keep the JAAS block in the standard layout: CassandraJavaClient { com.sun.security.auth.module.Krb5LoginModule required ...; };","Lint the JAAS file in CI with a regex check for Krb5LoginModule before deploy.","Never copy non-Kerberos JAAS files for Kerberos-enabled clusters.","Test JAAS parsing locally before rollout."],"tags":["kerberos","cassandra","config","jaas"],"backgroundTag":"jaas-config-invalid","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}