{"record":{"id":"369ae70f2e07c644","repo":"t8y2/dbx","slug":"kerberos-keytab-authentication-requires-a-keytab-p","errorCode":null,"errorMessage":"Kerberos keytab authentication requires a keytab path","messagePattern":"Kerberos keytab authentication requires a keytab path","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/cassandra-go/kerberos.go","lineNumber":198,"sourceCode":"\t\tconfig.ccachePath = defaultKerberosCCachePath()\n\t}\n\tconfig.ccachePath, err = normalizeKerberosCachePath(config.ccachePath)\n\tif err != nil {\n\t\treturn err\n\t}\n\tif err := requireRegularFile(\"Kerberos credential cache\", config.ccachePath); err != nil {\n\t\treturn err\n\t}\n\tconfig.credentialMode = kerberosCredentialCCache\n\treturn nil\n}\n\nfunc (config *kerberosConfig) selectKeytabCredential(krbConfig *krb5config.Config) error {\n\tvar err error\n\tif config.keytabPath == \"\" {\n\t\tconfig.keytabPath = firstNonEmpty(os.Getenv(\"KRB5_CLIENT_KTNAME\"), os.Getenv(\"KRB5_KTNAME\"))\n\t\tif config.keytabPath == \"\" {\n\t\t\treturn fmt.Errorf(\"Kerberos keytab authentication requires a keytab path\")\n\t\t}\n\t}\n\tconfig.keytabPath, err = normalizeKerberosFileReference(config.keytabPath)\n\tif err != nil {\n\t\treturn err\n\t}\n\tif err := requireRegularFile(\"Kerberos keytab\", config.keytabPath); err != nil {\n\t\treturn err\n\t}\n\tif config.principal == \"\" {\n\t\tconfig.principal, err = principalFromKeytab(config.keytabPath)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t}\n\tconfig.credentialUser, config.credentialRealm, err = splitKerberosPrincipal(\n\t\tconfig.principal,\n\t\tconfig.realm,","sourceCodeStart":180,"sourceCodeEnd":216,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/cassandra-go/kerberos.go#L180-L216","documentation":"selectKeytabCredential is invoked when keytab authentication was selected (useKeytab=true, or keytabPath set, or KRB5_*KTNAME env). If config.keytabPath is still empty after checking the KRB5_CLIENT_KTNAME and KRB5_KTNAME environment variables, the driver cannot locate a keytab file to load credentials from and aborts.","triggerScenarios":"Calling finalize with useKeytab=true while keytabPath is empty and neither KRB5_CLIENT_KTNAME nor KRB5_KTNAME is set in the process environment.","commonSituations":"Setting `use_keytab = true` in the driver config but forgetting to set the keytab path; running under systemd/Docker where KRB5_CLIENT_KTNAME was not propagated; keytab path defined in a shell profile that the service does not source.","solutions":["Set keytabPath in the kerberosConfig to an absolute path of an existing keytab file.","Export KRB5_CLIENT_KTNAME=/path/to/file.keytab (or KRB5_KTNAME) in the service environment.","Confirm the file exists and is readable by the process user (`ls -l` / `klist -kt`)."],"exampleFix":"// before\nuseKeytab: true // no keytabPath, no KRB5_CLIENT_KTNAME\n\n// after\nuseKeytab: true,\nkeytabPath: \"/etc/krb5.keytab\"","handlingStrategy":"validation","validationCode":"if cfg.useKeytab && cfg.keytabPath == \"\" && os.Getenv(\"KRB5_CLIENT_KTNAME\") == \"\" && os.Getenv(\"KRB5_KTNAME\") == \"\" {\n\treturn errors.New(\"useKeytab is set but no keytab path or KRB5_CLIENT_KTNAME/KRB5_KTNAME provided\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always set keytabPath explicitly when useKeytab=true; don't rely on env inheritance.","Document required env vars (KRB5_CLIENT_KTNAME) in your deployment manifest/systemd unit.","Validate the keytab file exists at boot with os.Stat before building the cluster."],"tags":["kerberos","keytab","configuration","golang"],"backgroundTag":"missing-kerberos-keytab","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}