{"record":{"id":"5768d095468d33eb","repo":"t8y2/dbx","slug":"kerberos-authentication-is-not-enabled","errorCode":null,"errorMessage":"Kerberos authentication is not enabled","messagePattern":"Kerberos authentication is not enabled","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/cassandra-go/kerberos.go","lineNumber":232,"sourceCode":"\tconfig.credentialUser, config.credentialRealm, err = splitKerberosPrincipal(\n\t\tconfig.principal,\n\t\tconfig.realm,\n\t\tkrbConfig.LibDefaults.DefaultRealm,\n\t)\n\tif err != nil {\n\t\treturn err\n\t}\n\tconfig.credentialMode = kerberosCredentialKeytab\n\treturn nil\n}\n\nfunc newKerberosAuthProvider(\n\tconfig kerberosConfig,\n\tusername string,\n\tpassword string,\n) (func(*gocql.HostInfo) (gocql.Authenticator, error), error) {\n\tif !config.enabled {\n\t\treturn nil, fmt.Errorf(\"Kerberos authentication is not enabled\")\n\t}\n\tif config.credentialMode == kerberosCredentialNone {\n\t\tif err := config.finalize(username, password); err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t}\n\tkrbConfig, err := krb5config.Load(config.configPath)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"load Kerberos config %s: %w\", config.configPath, err)\n\t}\n\treturn func(host *gocql.HostInfo) (gocql.Authenticator, error) {\n\t\treturn newKerberosAuthenticator(config, krbConfig, host)\n\t}, nil\n}\n\nfunc newKerberosAuthenticator(\n\tconfig kerberosConfig,\n\tkrbConfig *krb5config.Config,","sourceCodeStart":214,"sourceCodeEnd":250,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/cassandra-go/kerberos.go#L214-L250","documentation":"newKerberosAuthProvider returns this immediately when config.enabled is false, i.e. Kerberos authentication was not turned on for this cluster configuration, yet the code path tried to construct a Kerberos auth provider. It is an internal consistency guard: the auth provider factory only works when Kerberos was explicitly enabled.","triggerScenarios":"Requesting a Kerberos gocql authenticator provider via newKerberosAuthProvider (through clusterConfig) while the kerberosConfig has enabled=false — e.g. Kerberos settings present in config but an enable flag not set, or the wrong config section parsed.","commonSituations":"Configuring Kerberos options (principal, keytab, etc.) but forgetting the master enable flag like `kerberos.enabled=true` in the driver config; typo in the config key so enabled stays false.","solutions":["Set enabled=true on the kerberosConfig (or the corresponding config-file flag) before building the provider.","Check the config file/keys are parsed into the kerberosConfig that is actually passed to clusterConfig.","If Kerberos is not intended, remove the Kerberos settings or switch to PasswordAuthenticator."],"exampleFix":"// before\nclusterConfig(kerberosConfig{principal: \"user@EXAMPLE.COM\"}) // enabled defaults to false\n\n// after\nclusterConfig(kerberosConfig{enabled: true, principal: \"user@EXAMPLE.COM\", useKeytab: true, keytabPath: \"/etc/krb5.keytab\"})","handlingStrategy":"validation","validationCode":"if wantsKerberos(cfg) && !cfg.enabled {\n\treturn errors.New(\"kerberos options present but enabled=false; set enabled=true\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Treat enabled as the master switch; verify config parsing maps the right key (e.g. kerberos.enabled) onto it.","Fail fast at startup by asserting enabled==true whenever other kerberos fields are non-zero.","Add a unit test asserting the parsed config's enabled flag for your config file."],"tags":["kerberos","configuration","authentication","golang"],"backgroundTag":"feature-not-enabled","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}