{"record":{"id":"3730a493f2878016","repo":"t8y2/dbx","slug":"create-kerberos-client-from-credential-cache-w","errorCode":null,"errorMessage":"create Kerberos client from credential cache: %w","messagePattern":"create Kerberos client from credential cache: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/cassandra-go/kerberos.go","lineNumber":295,"sourceCode":"\t\tticket:          ticket,\n\t\tsessionKey:      sessionKey,\n\t\tauthorizationID: config.authorizationID,\n\t}\n\tclient.Destroy()\n\treturn authenticator, nil\n}\n\nfunc newKerberosClient(config kerberosConfig, krbConfig *krb5config.Config) (*krb5client.Client, error) {\n\tsettings := []func(*krb5client.Settings){krb5client.DisablePAFXFAST(config.disablePAFXFAST)}\n\tswitch config.credentialMode {\n\tcase kerberosCredentialCCache:\n\t\tcache, err := credentials.LoadCCache(config.ccachePath)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"load Kerberos credential cache %s: %w\", config.ccachePath, err)\n\t\t}\n\t\tclient, err := krb5client.NewFromCCache(cache, krbConfig, settings...)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"create Kerberos client from credential cache: %w\", err)\n\t\t}\n\t\treturn client, nil\n\tcase kerberosCredentialKeytab:\n\t\tloadedKeytab, err := keytab.Load(config.keytabPath)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"load Kerberos keytab %s: %w\", config.keytabPath, err)\n\t\t}\n\t\treturn krb5client.NewWithKeytab(\n\t\t\tconfig.credentialUser,\n\t\t\tconfig.credentialRealm,\n\t\t\tloadedKeytab,\n\t\t\tkrbConfig,\n\t\t\tsettings...,\n\t\t), nil\n\tcase kerberosCredentialPassword:\n\t\treturn krb5client.NewWithPassword(\n\t\t\tconfig.credentialUser,\n\t\t\tconfig.credentialRealm,","sourceCodeStart":277,"sourceCodeEnd":313,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/cassandra-go/kerberos.go#L277-L313","documentation":"After a ccache file is successfully loaded, krb5client.NewFromCCache builds a client from it. Failure here means the cache contents are unusable for authentication: the principal's realm is unknown, credentials are expired/invalid, or the cache does not match the configured krb5 realms.","triggerScenarios":"LoadCCache succeeded but krb5client.NewFromCCache returns an error — e.g. ccache contains a principal whose realm has no entry in krb5.conf, expired tickets, or malformed/incompatible cache entries.","commonSituations":"krb5.conf missing the realm of the cached principal; ticket expired between kinit and connect; ccache from a different realm than config.realm.","solutions":["Re-run `kinit` to refresh credentials and try again.","Add/fix the principal's realm in krb5.conf (realms and domain_realm sections).","Verify the cached principal matches the expected user/realm (`klist -c <path>`)."],"exampleFix":"// before: krb5.conf lacks EXAMPLE.COM realm\n// after\n// [realms]\n//   EXAMPLE.COM = { kdc = kdc.example.com }","handlingStrategy":"validation","validationCode":"// confirm realm of cached principal is in krb5.conf:\ncache, err := credentials.LoadCCache(path)\nif err == nil {\n\trealm := cache.Credentials.Domain()\n\tif !krbConfHasRealm(realm) {\n\t\treturn fmt.Errorf(\"ccache principal realm %q missing from krb5.conf\", realm)\n\t}\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep krb5.conf realms/domain_realm sections covering every realm your principals use.","Refresh tickets before expiry so NewFromCCache never sees stale credentials.","Verify with `klist -c <path>` that the expected principal/realm is cached."],"tags":["kerberos","ccache","credentials","golang"],"backgroundTag":"kerberos-client-creation-failed","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}