{"record":{"id":"0d198c08c43d9947","repo":"t8y2/dbx","slug":"kerberos-principal-is-empty","errorCode":null,"errorMessage":"Kerberos principal is empty","messagePattern":"Kerberos principal is empty","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/cassandra-go/kerberos.go","lineNumber":556,"sourceCode":"\tif strings.HasPrefix(strings.ToUpper(value), \"FILE:\") {\n\t\tvalue = value[5:]\n\t}\n\tpath, err := normalizeLocalFilePath(value)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"invalid Kerberos file path: %w\", err)\n\t}\n\treturn path, nil\n}\n\nfunc splitKerberosPrincipal(principal, configuredRealm, defaultRealm string) (string, string, error) {\n\tvalue := strings.TrimSpace(principal)\n\trealm := strings.TrimSpace(configuredRealm)\n\tif separator := strings.LastIndexByte(value, '@'); separator >= 0 {\n\t\trealm = value[separator+1:]\n\t\tvalue = value[:separator]\n\t}\n\tif value == \"\" {\n\t\treturn \"\", \"\", fmt.Errorf(\"Kerberos principal is empty\")\n\t}\n\tif realm == \"\" {\n\t\trealm = strings.TrimSpace(defaultRealm)\n\t}\n\tif realm == \"\" {\n\t\treturn \"\", \"\", fmt.Errorf(\"Kerberos realm is required for principal %s\", principal)\n\t}\n\treturn value, realm, nil\n}\n\nfunc principalFromKeytab(path string) (string, error) {\n\tloadedKeytab, err := keytab.Load(path)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"load Kerberos keytab %s: %w\", path, err)\n\t}\n\tprincipals := map[string]struct{}{}\n\tfor _, entry := range loadedKeytab.Entries {\n\t\tprincipals[entry.Principal.String()] = struct{}{}","sourceCodeStart":538,"sourceCodeEnd":574,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/cassandra-go/kerberos.go#L538-L574","documentation":"splitKerberosPrincipal splits a Kerberos principal into user part and realm (on the last '@') and rejects an empty user part. The principal string was empty/whitespace, or consisted solely of a realm like `@EXAMPLE.COM`, so there is no principal name to authenticate with.","triggerScenarios":"finalize/selectKeytabCredential call splitKerberosPrincipal with a principal that trims to empty, or with `@REALM` only; e.g. kerberosprincipal config/JAAS `principal=` empty while keytab auth requires one and the keytab could not supply a unique principal.","commonSituations":"Empty `principal=\"\"` in config; JAAS `principal=` with no value; env-var interpolation that resolved to an empty string in a deployment template; typo leaving only the realm.","solutions":["Set the principal explicitly, e.g. cassandra/host@EXAMPLE.COM, in the driver config or JAAS `principal=` option.","If the principal should come from the keytab, remove the empty setting so principalFromKeytab can derive it (requires a single-principal keytab).","Fix template/env interpolation so KERBEROS_PRINCIPAL-like variables resolve to a non-empty value.","Verify the string has a non-empty part before the last '@'."],"exampleFix":"// before\nprincipal=\"@EXAMPLE.COM\"\n// after\nprincipal=\"svc-cassandra@EXAMPLE.COM\"","handlingStrategy":"validation","validationCode":"func validatePrincipal(p string) error {\n\tp = strings.TrimSpace(p)\n\tif p == \"\" { return fmt.Errorf(\"principal not set\") }\n\tif strings.HasPrefix(p, \"@\") { return fmt.Errorf(\"principal missing user part\") }\n\treturn nil\n}","typeGuard":"func hasPrincipalUserPart(p string) bool {\n\tp = strings.TrimSpace(p)\n\tat := strings.LastIndexByte(p, '@')\n\treturn len(p) > 0 && (at != 0)\n}","tryCatchPattern":"if err := client.Finalize(); err != nil {\n\tif strings.Contains(err.Error(), \"Kerberos principal is empty\") {\n\t\tlog.Fatal(\"set kerberosprincipal (e.g. svc@EXAMPLE.COM) or use a single-principal keytab\")\n\t}\n\treturn err\n}","preventionTips":["Always set a full principal in config or JAAS.","Check env/template interpolation for empty variables before deploy.","Rely on single-principal keytab auto-detection only when principal is intentionally unset.","Add a startup assert that the principal is non-empty."],"tags":["kerberos","cassandra","principal","config"],"backgroundTag":"kerberos-principal-invalid","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}