{"record":{"id":"1542fc10a4d687cc","repo":"t8y2/dbx","slug":"read-kerberos-jaas-config-w","errorCode":null,"errorMessage":"read Kerberos JAAS config: %w","messagePattern":"read Kerberos JAAS config: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/argo-go/config.go","lineNumber":961,"sourceCode":"\tif kerberos.KeytabPath != \"\" {\n\t\tkerberos.UseKeytab = true\n\t}\n\tif kerberos.CCachePath != \"\" {\n\t\tkerberos.UseTicketCache = true\n\t}\n\tkerberos.Realm = firstNonEmpty(kerberos.Realm, realmFromPrincipal(kerberos.ClientPrincipal))\n\tif !kerberos.UseTicketCache && !kerberos.UseKeytab && (kerberos.ClientPrincipal == \"\" || kerberos.Password == \"\") {\n\t\treturn errors.New(\"Kerberos requires SSPI, credential cache, keytab, or principal and password\")\n\t}\n\treturn nil\n}\n\nvar jaasOptionPattern = regexp.MustCompile(`(?i)\\b(principal|keytab|ticketcache|usekeytab|useticketcache)\\s*=\\s*(\"(?:\\\\.|[^\"])*\"|'(?:\\\\.|[^'])*'|[^\\s;]+)`)\n\nfunc applyKerberosJAASFile(config *kerberosConfig) error {\n\tcontents, err := os.ReadFile(config.JAASConfigPath)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"read Kerberos JAAS config: %w\", err)\n\t}\n\ttext := string(contents)\n\tmodule := strings.Index(strings.ToLower(text), \"krb5loginmodule\")\n\tif module < 0 {\n\t\treturn errors.New(\"Kerberos JAAS config contains no Krb5LoginModule\")\n\t}\n\tblock := text[module:]\n\tif end := strings.IndexByte(block, ';'); end >= 0 {\n\t\tblock = block[:end]\n\t}\n\tfor _, match := range jaasOptionPattern.FindAllStringSubmatch(block, -1) {\n\t\tkey := strings.ToLower(match[1])\n\t\tvalue := decodeJAASValue(match[2])\n\t\tswitch key {\n\t\tcase \"principal\":\n\t\t\tif config.ClientPrincipal == \"\" {\n\t\t\t\tconfig.ClientPrincipal = value\n\t\t\t}","sourceCodeStart":943,"sourceCodeEnd":979,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/argo-go/config.go#L943-L979","documentation":"This error wraps the underlying os.ReadFile failure when the driver tries to load a Kerberos JAAS config file whose path was given via kerberosConfig.JAASConfigPath. The %w preserves the OS-level cause (e.g. 'no such file or directory', 'permission denied') so callers can errors.Is/As the wrapped error. The library throws it because it cannot proceed to parse the Krb5LoginModule block without the file contents.","triggerScenarios":"Calling the driver's config/connect path with Kerberos enabled and a JAAS config path set (JAASConfigPath), where applyKerberosJAASFile fails on os.ReadFile — file missing, wrong path, or unreadable permissions.","commonSituations":"Typos in the JAAS config path in the connection string/config; file deployed on a different host than the driver; running the process under a service account lacking read permission; container image not mounting the secret containing the JAAS file.","solutions":["Verify the JAAS config path exists and is readable by the process user (ls -l / stat)","Fix the path in the config/connection string to the absolute location of the JAAS file","Mount the JAAS file (e.g. Kubernetes secret volume) into the container at the expected path","Check the error's wrapped cause (%w) to distinguish not-found vs permission issues and fix accordingly"],"exampleFix":"// before\njaasPath := \"/etc/krb5/jaas.conf\" // file not present\n// after\nif _, err := os.Stat(jaasPath); err != nil {\n    log.Fatalf(\"JAAS config missing at %s: %v\", jaasPath, err)\n}","handlingStrategy":"validation","validationCode":"if cfg.JAASConfigPath != \"\" {\n    if fi, err := os.Stat(cfg.JAASConfigPath); err != nil || fi.IsDir() {\n        return fmt.Errorf(\"Kerberos JAAS config not readable at %s\", cfg.JAASConfigPath)\n    }\n}","typeGuard":null,"tryCatchPattern":"if _, err := client.Connect(ctx); err != nil {\n    var pathErr *os.PathError\n    if errors.As(err, &pathErr) && errors.Is(err, os.ErrNotExist) {\n        log.Fatalf(\"JAAS config missing: %s\", pathErr.Path)\n    }\n    return err\n}","preventionTips":["Stat the JAAS path during application startup, before first connect","Use absolute paths and mount the JAAS file as a secret volume in containers","Verify file readability under the service account, not your dev user","Add a startup check that the file contains Krb5LoginModule"],"tags":["kerberos","file-io","config"],"backgroundTag":"file-not-found","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}