{"record":{"id":"596933ce0a3f4a99","repo":"t8y2/dbx","slug":"kerberos-ticket-cache-path-is-empty","errorCode":null,"errorMessage":"Kerberos ticket cache path is empty","messagePattern":"Kerberos ticket cache path is empty","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/cassandra-go/kerberos.go","lineNumber":515,"sourceCode":"\t}\n\treturn nil\n}\n\nfunc javaSystemProperty(name string) string {\n\tpattern := regexp.MustCompile(`(?:^|\\s)-D` + regexp.QuoteMeta(name) + `=(?:\"([^\"]*)\"|'([^']*)'|(\\S+))`)\n\tfor _, environmentName := range []string{\"JAVA_TOOL_OPTIONS\", \"_JAVA_OPTIONS\", \"JDK_JAVA_OPTIONS\"} {\n\t\tmatch := pattern.FindStringSubmatch(os.Getenv(environmentName))\n\t\tif len(match) == 4 {\n\t\t\treturn firstNonEmpty(match[1], match[2], match[3])\n\t\t}\n\t}\n\treturn \"\"\n}\n\nfunc normalizeKerberosCachePath(raw string) (string, error) {\n\tvalue := strings.TrimSpace(raw)\n\tif value == \"\" {\n\t\treturn \"\", fmt.Errorf(\"Kerberos ticket cache path is empty\")\n\t}\n\tif separator := strings.IndexByte(value, ':'); separator > 0 && !isWindowsDrivePath(value) {\n\t\tcacheType := strings.ToUpper(value[:separator])\n\t\tif cacheType != \"FILE\" {\n\t\t\treturn \"\", fmt.Errorf(\"Kerberos credential cache type %s is not supported; use a FILE cache or keytab\", cacheType)\n\t\t}\n\t\tvalue = value[separator+1:]\n\t}\n\tpath, err := normalizeLocalFilePath(value)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"invalid Kerberos credential cache path: %w\", err)\n\t}\n\treturn path, nil\n}\n\nfunc isWindowsDrivePath(value string) bool {\n\treturn len(value) >= 3 && ((value[0] >= 'A' && value[0] <= 'Z') || (value[0] >= 'a' && value[0] <= 'z')) &&\n\t\tvalue[1] == ':' && (value[2] == '\\\\' || value[2] == '/')","sourceCodeStart":497,"sourceCodeEnd":533,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/cassandra-go/kerberos.go#L497-L533","documentation":"normalizeKerberosCachePath was given an empty (or whitespace-only) ticket-cache path. This library requires an explicit FILE credential-cache path to authenticate with a ccache; nothing was configured (no TicketCache option, no KRB5CCNAME-resolvable default).","triggerScenarios":"selectCCacheCredential / finalize resolve the ccache path (config option, KRB5CCNAME, or default /tmp/krb5cc_<uid>) and the resulting raw string trims to empty.","commonSituations":"KRB5CCNAME is set to an empty string; the ticketcache config/JAAS option is `ticketcache=\"\"`; running in a container where user.Current() fails so the default /tmp/krb5cc_<uid> cannot be computed and no kinit has ever run.","solutions":["Set the ticket cache path explicitly in the driver config (or JAAS `TicketCache=` option) to the ccache file, e.g. /tmp/krb5cc_1000.","Ensure KRB5CCNAME points to a FILE cache and run `kinit` so the file exists.","If keytab auth is intended instead, clear the ccache setting and configure keyTab/principal so the keytab path is selected."],"exampleFix":"// before\ncluster.KerberosTicketCachePath = os.Getenv(\"KRB5CCNAME\") // \"\"\n// after\ncluster.KerberosTicketCachePath = \"/tmp/krb5cc_1000\" // or run kinit first so KRB5CCNAME resolves","handlingStrategy":"validation","validationCode":"func ensureCCache(path string) (string, error) {\n\tp := strings.TrimSpace(path)\n\tif p == \"\" { p = os.Getenv(\"KRB5CCNAME\") }\n\tif p == \"\" {\n\t\tu, err := user.Current()\n\t\tif err != nil { return \"\", fmt.Errorf(\"no ccache path available\") }\n\t\tp = filepath.Join(os.TempDir(), \"krb5cc_\"+u.Uid)\n\t}\n\tif _, err := os.Stat(strings.TrimPrefix(p, \"FILE:\")); err != nil {\n\t\treturn \"\", fmt.Errorf(\"ccache %s missing; run kinit\", p)\n\t}\n\treturn p, nil\n}","typeGuard":null,"tryCatchPattern":"if err := client.Finalize(); err != nil {\n\tif strings.Contains(err.Error(), \"ticket cache path is empty\") {\n\t\tlog.Fatal(\"set ticketcache path or run kinit so KRB5CCNAME resolves\")\n\t}\n\treturn err\n}","preventionTips":["Always run kinit (or configure keytab auth) before starting the app.","Set KRB5CCNAME=FILE:/path explicitly in the service environment.","Avoid overriding ticketcache with an empty string in config/templates.","Check `klist` in startup health scripts."],"tags":["kerberos","cassandra","config","path"],"backgroundTag":"kerberos-credential-cache-missing","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}