{"record":{"id":"2c045cdc54dbf16e","repo":"t8y2/dbx","slug":"kerberos-credentials-are-not-configured","errorCode":null,"errorMessage":"Kerberos credentials are not configured","messagePattern":"Kerberos credentials are not configured","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/cassandra-go/kerberos.go","lineNumber":319,"sourceCode":"\t\t\treturn nil, fmt.Errorf(\"load Kerberos keytab %s: %w\", config.keytabPath, err)\n\t\t}\n\t\treturn krb5client.NewWithKeytab(\n\t\t\tconfig.credentialUser,\n\t\t\tconfig.credentialRealm,\n\t\t\tloadedKeytab,\n\t\t\tkrbConfig,\n\t\t\tsettings...,\n\t\t), nil\n\tcase kerberosCredentialPassword:\n\t\treturn krb5client.NewWithPassword(\n\t\t\tconfig.credentialUser,\n\t\t\tconfig.credentialRealm,\n\t\t\tconfig.password,\n\t\t\tkrbConfig,\n\t\t\tsettings...,\n\t\t), nil\n\tdefault:\n\t\treturn nil, fmt.Errorf(\"Kerberos credentials are not configured\")\n\t}\n}\n\nfunc (authenticator *kerberosAuthenticator) Challenge(request []byte) ([]byte, gocql.Authenticator, error) {\n\tswitch authenticator.step {\n\tcase 0:\n\t\ttoken, err := authenticator.initialToken()\n\t\tif err != nil {\n\t\t\treturn nil, nil, err\n\t\t}\n\t\tauthenticator.step = 1\n\t\treturn token, authenticator, nil\n\tcase 1:\n\t\ttoken, err := authenticator.securityLayerResponse(request)\n\t\tif err != nil {\n\t\t\treturn nil, nil, err\n\t\t}\n\t\tauthenticator.step = 2","sourceCodeStart":301,"sourceCodeEnd":337,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/cassandra-go/kerberos.go#L301-L337","documentation":"The default branch of newKerberosClient's credential-mode switch is reached when config.credentialMode is neither ccache, keytab, nor password — i.e. credentials were never resolved. Normally finalize() prevents this, so this is a defensive error signaling the kerberosConfig was constructed without running credential resolution or with an unset/unknown mode.","triggerScenarios":"newKerberosAuthenticator -> newKerberosClient called with a kerberosConfig whose credentialMode is kerberosCredentialNone (or an invalid value) — e.g. a config passed around that skipped newKerberosAuthProvider's finalize step.","commonSituations":"Custom code building a kerberosConfig directly and invoking the authenticator without finalize; refactors that construct the provider differently; internal wiring bugs where enabled=true short-circuits differently.","solutions":["Ensure the config flows through newKerberosAuthProvider (which calls finalize) rather than constructing authenticators directly.","Set one explicit credential source: ccachePath, keytabPath+useKeytab, or principal+password.","If you build the config manually, call the same credential-resolution path (finalize) before creating clients."],"exampleFix":"// before: hand-rolled authenticator\nauth := newKerberosAuthenticator(rawCfg, krbCfg, host) // credentialMode still none\n\n// after\nprovider, err := newKerberosAuthProvider(cfg, username, password) // runs finalize","handlingStrategy":"validation","validationCode":"func validateCredentialMode(cfg kerberosConfig) error {\n\tswitch cfg.credentialMode {\n\tcase kerberosCredentialCCache, kerberosCredentialKeytab, kerberosCredentialPassword:\n\t\treturn nil\n\tcase kerberosCredentialNone:\n\t\treturn errors.New(\"kerberos credential mode unresolved: provide ccache, keytab, or principal+password and run finalize\")\n\tdefault:\n\t\treturn fmt.Errorf(\"unknown kerberos credential mode %d\", cfg.credentialMode)\n\t}\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always obtain the authenticator via newKerberosAuthProvider instead of constructing clients directly.","Keep credentialMode unexported/resolved solely through finalize to prevent partial configs.","Add a unit test that every supported configuration path resolves credentialMode to a known value."],"tags":["kerberos","configuration","credentials","golang"],"backgroundTag":"missing-kerberos-credentials","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}