{"record":{"id":"256d9da80c71aff5","repo":"t8y2/dbx","slug":"kerberos-credential-cache-type-s-is-not-supported","errorCode":null,"errorMessage":"Kerberos credential cache type %s is not supported; use a FILE cache or keytab","messagePattern":"Kerberos credential cache type (.+?) is not supported; use a FILE cache or keytab","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/cassandra-go/kerberos.go","lineNumber":520,"sourceCode":"\tpattern := regexp.MustCompile(`(?:^|\\s)-D` + regexp.QuoteMeta(name) + `=(?:\"([^\"]*)\"|'([^']*)'|(\\S+))`)\n\tfor _, environmentName := range []string{\"JAVA_TOOL_OPTIONS\", \"_JAVA_OPTIONS\", \"JDK_JAVA_OPTIONS\"} {\n\t\tmatch := pattern.FindStringSubmatch(os.Getenv(environmentName))\n\t\tif len(match) == 4 {\n\t\t\treturn firstNonEmpty(match[1], match[2], match[3])\n\t\t}\n\t}\n\treturn \"\"\n}\n\nfunc normalizeKerberosCachePath(raw string) (string, error) {\n\tvalue := strings.TrimSpace(raw)\n\tif value == \"\" {\n\t\treturn \"\", fmt.Errorf(\"Kerberos ticket cache path is empty\")\n\t}\n\tif separator := strings.IndexByte(value, ':'); separator > 0 && !isWindowsDrivePath(value) {\n\t\tcacheType := strings.ToUpper(value[:separator])\n\t\tif cacheType != \"FILE\" {\n\t\t\treturn \"\", fmt.Errorf(\"Kerberos credential cache type %s is not supported; use a FILE cache or keytab\", cacheType)\n\t\t}\n\t\tvalue = value[separator+1:]\n\t}\n\tpath, err := normalizeLocalFilePath(value)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"invalid Kerberos credential cache path: %w\", err)\n\t}\n\treturn path, nil\n}\n\nfunc isWindowsDrivePath(value string) bool {\n\treturn len(value) >= 3 && ((value[0] >= 'A' && value[0] <= 'Z') || (value[0] >= 'a' && value[0] <= 'z')) &&\n\t\tvalue[1] == ':' && (value[2] == '\\\\' || value[2] == '/')\n}\n\nfunc normalizeKerberosFileReference(raw string) (string, error) {\n\tvalue := strings.TrimSpace(raw)\n\tif strings.HasPrefix(strings.ToUpper(value), \"FILE:\") {","sourceCodeStart":502,"sourceCodeEnd":538,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/cassandra-go/kerberos.go#L502-L538","documentation":"The ticket cache path used a cache-type prefix other than FILE (e.g. KEYRING:, DIR:, MEMORY:, KCM:). This library only supports FILE-format credential caches (or keytabs); it parses `TYPE:path` and rejects any TYPE that is not FILE. Windows drive paths (C:\\...) are exempted from prefix interpretation.","triggerScenarios":"KRB5CCNAME or the ticketcache config option is set to something like `DIR::/run/user/1000/krb5cc`, `KEYRING:persistent:1000`, `KCM:1000`, or `MEMORY:`; normalizeKerberosCachePath splits on the first ':' and rejects the uppercase prefix.","commonSituations":"Modern Linux distros default KRB5CCNAME to KEYRING: or DIR: caches; systemd user sessions use DIR:; kinit in containers configured with KCM. The driver cannot read these formats.","solutions":["Switch to a FILE cache: `export KRB5CCNAME=FILE:/tmp/krb5cc_1000` and run `kinit -c FILE:/tmp/krb5cc_1000`.","In krb5.conf, change default_ccache_name to a FILE path (e.g. /tmp/krb5cc_%{uid}).","Use keytab authentication instead (keyTab + principal in config) to bypass the ccache entirely.","On Windows, keep normal drive-letter paths (C:\\...) which are correctly not treated as cache-type prefixes."],"exampleFix":"// before\nexport KRB5CCNAME=KEYRING:persistent:1000\n// after\nexport KRB5CCNAME=FILE:/tmp/krb5cc_1000 && kinit -c FILE:/tmp/krb5cc_1000","handlingStrategy":"validation","validationCode":"func ensureFileCCache(name string) error {\n\tif i := strings.IndexByte(name, ':'); i > 0 && !regexp.MustCompile(`^[A-Za-z]:[\\\\/]`).MatchString(name) {\n\t\tif !strings.EqualFold(name[:i], \"FILE\") {\n\t\t\treturn fmt.Errorf(\"ccache type %s unsupported; use FILE:/path\", name[:i])\n\t\t}\n\t}\n\treturn nil\n}","typeGuard":null,"tryCatchPattern":"if err := client.Finalize(); err != nil {\n\tif strings.Contains(err.Error(), \"is not supported; use a FILE cache\") {\n\t\tlog.Fatalf(\"KRB5CCNAME uses unsupported cache type; set KRB5CCNAME=FILE:/tmp/krb5cc_$(id -u)\")\n\t}\n\treturn err\n}","preventionTips":["Export KRB5CCNAME=FILE:... in systemd units/containers instead of relying on distro defaults.","Change default_ccache_name in krb5.conf to a FILE path.","Prefer keytab auth in headless environments to avoid ccache formats entirely.","Smoke-test auth with `klist` showing a FILE cache."],"tags":["kerberos","cassandra","ccache","unsupported"],"backgroundTag":"kerberos-ccache-type-unsupported","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}