{"record":{"id":"3dec9c95c295334c","repo":"t8y2/dbx","slug":"cassandra-reported-kerberos-success-before-sasl-ne","errorCode":null,"errorMessage":"Cassandra reported Kerberos success before SASL negotiation completed","messagePattern":"Cassandra reported Kerberos success before SASL negotiation completed","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/cassandra-go/kerberos.go","lineNumber":346,"sourceCode":"\t\t\treturn nil, nil, err\n\t\t}\n\t\tauthenticator.step = 1\n\t\treturn token, authenticator, nil\n\tcase 1:\n\t\ttoken, err := authenticator.securityLayerResponse(request)\n\t\tif err != nil {\n\t\t\treturn nil, nil, err\n\t\t}\n\t\tauthenticator.step = 2\n\t\treturn token, authenticator, nil\n\tdefault:\n\t\treturn nil, nil, fmt.Errorf(\"unexpected Cassandra Kerberos authentication challenge\")\n\t}\n}\n\nfunc (authenticator *kerberosAuthenticator) Success(_ []byte) error {\n\tif authenticator.step != 2 {\n\t\treturn fmt.Errorf(\"Cassandra reported Kerberos success before SASL negotiation completed\")\n\t}\n\treturn nil\n}\n\nfunc (authenticator *kerberosAuthenticator) initialToken() ([]byte, error) {\n\tvalue, err := types.NewAuthenticator(authenticator.domain, authenticator.clientName)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tvalue.Cksum = types.Checksum{\n\t\tCksumType: chksumtype.GSSAPI,\n\t\tChecksum:  kerberosAuthenticatorChecksum(),\n\t}\n\trequest, err := messages.NewAPReq(authenticator.ticket, authenticator.sessionKey, value)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tpayload := make([]byte, 2)","sourceCodeStart":328,"sourceCodeEnd":364,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/cassandra-go/kerberos.go#L328-L364","documentation":"Returned by kerberosAuthenticator.Success when Cassandra signals authentication success while the authenticator is still at negotiation step 0 or 1 — i.e. the server accepted before the client sent its AP-REQ/security-layer token. This guards against a truncated or mis-sequenced SASL exchange that would otherwise leave the session without an established security layer.","triggerScenarios":"Thrown at agents/drivers/cassandra-go/kerberos.go:346 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Verify the Cassandra server's SASL mechanism is Kerberos (GSSAPI) and not a simpler mechanism that finishes early","Check for a mismatch between server and client QOP/security-layer expectations","Ensure the driver and server agree on the Kerberos protocol version"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}