{"record":{"id":"25c84de3cf7688ce","repo":"mongodb/node-mongodb-native","slug":"connection-must-have-host-and-port-and-credentials","errorCode":null,"errorMessage":"Connection must have host and port and credentials defined.","messagePattern":"Connection must have host and port and credentials defined\\.","errorType":"exception","errorClass":"MongoInvalidArgumentError","httpStatus":null,"severity":"critical","filePath":"src/cmap/auth/gssapi.ts","lineNumber":76,"sourceCode":"      saslContinue(negotiatedPayload, saslStartResponse.conversationId)\n    );\n\n    const finalizePayload = await finalize(client, username, saslContinueResponse.payload);\n\n    await externalCommand(connection, {\n      saslContinue: 1,\n      conversationId: saslContinueResponse.conversationId,\n      payload: finalizePayload\n    });\n  }\n}\n\nasync function makeKerberosClient({\n  options: { hostAddress, runtime },\n  credentials\n}: AuthContext): Promise<KerberosClient> {\n  if (!hostAddress || typeof hostAddress.host !== 'string' || !credentials) {\n    throw new MongoInvalidArgumentError(\n      'Connection must have host and port and credentials defined.'\n    );\n  }\n\n  const { os } = await runtime;\n\n  loadKrb();\n  if ('kModuleError' in krb) {\n    throw krb['kModuleError'];\n  }\n  const { initializeClient } = krb;\n\n  const { username, password } = credentials;\n  const mechanismProperties = credentials.mechanismProperties as MechanismProperties;\n\n  const serviceName = mechanismProperties.SERVICE_NAME ?? 'mongodb';\n\n  const host = await performGSSAPICanonicalizeHostName(hostAddress.host, mechanismProperties);","sourceCodeStart":58,"sourceCodeEnd":94,"githubUrl":"https://github.com/mongodb/node-mongodb-native/blob/dce7939f86fb283e167ad709955abedb7bf23124/src/cmap/auth/gssapi.ts#L58-L94","documentation":"Internal guard in makeKerberosClient: the connection has no hostAddress.host or no credentials, so a Kerberos client cannot be initialised. It is a MongoInvalidArgumentError thrown before the kerberos library is loaded. Normally the SDAM layer guarantees a host; hitting this means the connection/stream was misconstructed or already closed.","triggerScenarios":"An AuthContext built from a connection whose hostAddress is undefined (e.g. mocking or a torn-down connection); credentials cleared between server selection and auth; a driver-internal wiring problem after a topology change.","commonSituations":"Driver bug in connection lifecycle; custom AuthProvider/test harness creating an AuthContext without a host; GSSAPI attempted on a connection that lost its endpoint.","solutions":["Use the standard MongoClient connection path — do not construct AuthContext/Connection manually.","If this appears in tests, ensure mocks provide a hostAddress with a string host and a credentials object.","Upgrade the driver; a missing hostAddress during GSSAPI is usually an internal-lifecycle defect that gets fixed."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":["Do not construct AuthContext/Connection manually outside the driver.","In tests, provide a hostAddress with a string host and credentials when mocking GSSAPI auth.","Keep the driver updated to avoid connection-lifecycle defects."],"tags":["auth","kerberos","gssapi","internal"],"backgroundTag":null,"analyzedSha":"dce7939f86fb283e167ad709955abedb7bf23124","analyzedAt":"2026-08-11T04:54:53.215Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}