{"record":{"id":"5ba7217a61ddf2db","repo":"t8y2/dbx","slug":"load-kerberos-credential-cache-s-w","errorCode":null,"errorMessage":"load Kerberos credential cache %s: %w","messagePattern":"load Kerberos credential cache (.+?): %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/cassandra-go/kerberos.go","lineNumber":291,"sourceCode":"\tclientName.NameString = append([]string(nil), clientName.NameString...)\n\tauthenticator := &kerberosAuthenticator{\n\t\tdomain:          strings.Clone(client.Credentials.Domain()),\n\t\tclientName:      clientName,\n\t\tticket:          ticket,\n\t\tsessionKey:      sessionKey,\n\t\tauthorizationID: config.authorizationID,\n\t}\n\tclient.Destroy()\n\treturn authenticator, nil\n}\n\nfunc newKerberosClient(config kerberosConfig, krbConfig *krb5config.Config) (*krb5client.Client, error) {\n\tsettings := []func(*krb5client.Settings){krb5client.DisablePAFXFAST(config.disablePAFXFAST)}\n\tswitch config.credentialMode {\n\tcase kerberosCredentialCCache:\n\t\tcache, err := credentials.LoadCCache(config.ccachePath)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"load Kerberos credential cache %s: %w\", config.ccachePath, err)\n\t\t}\n\t\tclient, err := krb5client.NewFromCCache(cache, krbConfig, settings...)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"create Kerberos client from credential cache: %w\", err)\n\t\t}\n\t\treturn client, nil\n\tcase kerberosCredentialKeytab:\n\t\tloadedKeytab, err := keytab.Load(config.keytabPath)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"load Kerberos keytab %s: %w\", config.keytabPath, err)\n\t\t}\n\t\treturn krb5client.NewWithKeytab(\n\t\t\tconfig.credentialUser,\n\t\t\tconfig.credentialRealm,\n\t\t\tloadedKeytab,\n\t\t\tkrbConfig,\n\t\t\tsettings...,\n\t\t), nil","sourceCodeStart":273,"sourceCodeEnd":309,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/cassandra-go/kerberos.go#L273-L309","documentation":"In newKerberosClient, when the credential mode is ccache, credentials.LoadCCache reads the Kerberos credential cache file at config.ccachePath. Failure to read/parse it (missing file, unreadable permissions, corrupt format) is wrapped with the cache path.","triggerScenarios":"kerberosCredentialCCache selected (useTicketCache or ccachePath/default /tmp/krb5cc_<uid>) and LoadCCache fails: path does not exist, permissions deny read, or the file is not a valid ccache.","commonSituations":"No kinit was run so /tmp/krb5cc_1000 was never created; KRB5CCNAME points to a DIR:/cache collection the loader can't read; ccache created as root but app runs as another user; kinit performed in a different container/filesystem.","solutions":["Run `kinit <principal>` as the same user the app runs as; confirm the path in the error exists (`klist -c <path>`).","Fix file permissions/ownership of the ccache file.","Point ccachePath (or KRB5CCNAME) at a valid FILE: cache; convert DIR-type caches if the loader rejects them (`kinit` then copy FILE cache).","If tickets expired, re-authenticate with kinit."],"exampleFix":"// before: app user has no cache\n// shell: KRB5CCNAME unset, no kinit\n// after\n// kinit -c FILE:/tmp/app-krb5cc cassandra@EXAMPLE.COM\n// config: ccachePath: \"/tmp/app-krb5cc\"","handlingStrategy":"validation","validationCode":"func ensureCCache(path string) error {\n\tinfo, err := os.Stat(path)\n\tif err != nil { return fmt.Errorf(\"ccache missing at %s: %w\", path, err) }\n\tf, err := os.Open(path)\n\tif err != nil { return fmt.Errorf(\"ccache unreadable (permissions?): %w\", err) }\n\tdefer f.Close()\n\tvar magic [2]byte\n\tif _, err := io.ReadFull(f, magic[:]); err != nil || magic[0] != 0x05 {\n\t\treturn errors.New(\"not a valid FILE ccache\")\n\t}\n\treturn nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Run kinit as the same UID that runs the application.","Use FILE-type ccache (KRB5CCNAME=FILE:/path) for predictable loading.","Add ticket-lifetime monitoring; re-kinit via k5start/cron before expiry."],"tags":["kerberos","ccache","credentials","golang"],"backgroundTag":"kerberos-ccache-load-failed","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}