{"record":{"id":"623b8613b5500ce5","repo":"t8y2/dbx","slug":"get-kerberos-service-ticket-for-s-w","errorCode":null,"errorMessage":"get Kerberos service ticket for %s: %w","messagePattern":"get Kerberos service ticket for (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/cassandra-go/kerberos.go","lineNumber":270,"sourceCode":") (gocql.Authenticator, error) {\n\tclient, err := newKerberosClient(config, krbConfig)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tif err := client.Login(); err != nil {\n\t\tclient.Destroy()\n\t\treturn nil, fmt.Errorf(\"Kerberos login failed: %w\", err)\n\t}\n\tserverName, err := kerberosServerName(config, host)\n\tif err != nil {\n\t\tclient.Destroy()\n\t\treturn nil, err\n\t}\n\tservicePrincipal := config.serviceName + \"/\" + serverName\n\tticket, sessionKey, err := client.GetServiceTicket(servicePrincipal)\n\tif err != nil {\n\t\tclient.Destroy()\n\t\treturn nil, fmt.Errorf(\"get Kerberos service ticket for %s: %w\", servicePrincipal, err)\n\t}\n\tclientName := client.Credentials.CName()\n\tclientName.NameString = append([]string(nil), clientName.NameString...)\n\tauthenticator := &kerberosAuthenticator{\n\t\tdomain:          strings.Clone(client.Credentials.Domain()),\n\t\tclientName:      clientName,\n\t\tticket:          ticket,\n\t\tsessionKey:      sessionKey,\n\t\tauthorizationID: config.authorizationID,\n\t}\n\tclient.Destroy()\n\treturn authenticator, nil\n}\n\nfunc newKerberosClient(config kerberosConfig, krbConfig *krb5config.Config) (*krb5client.Client, error) {\n\tsettings := []func(*krb5client.Settings){krb5client.DisablePAFXFAST(config.disablePAFXFAST)}\n\tswitch config.credentialMode {\n\tcase kerberosCredentialCCache:","sourceCodeStart":252,"sourceCodeEnd":288,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/cassandra-go/kerberos.go#L252-L288","documentation":"After a successful login, the authenticator requests a service ticket for \"<serviceName>/<serverName>\" (default service \"cassandra\") from the KDC via client.GetServiceTicket. Failure means the KDC refused or could not issue a ticket for that service principal; the error is wrapped with the exact service principal used.","triggerScenarios":"GetServiceTicket fails for servicePrincipal = serviceName + \"/\" + serverName — the service principal (e.g. cassandra/node1.domain@REALM) does not exist in the KDC database, serverName resolution picked the wrong hostname, or cross-realm trust issues.","commonSituations":"Cassandra node registered in KDC under a different principal than the hostname the client resolved (missing reverse DNS/hostname mismatch); serviceName configured differently from the server's keytab (e.g. server uses 'dse' not 'cassandra'); principal not created in the realm.","solutions":["Check the principal in the error exists in the KDC: `kadmin: list_princs` and add it (`ank cassandra/<host>@REALM`) if missing.","Match config.serviceName to the service part of the server's actual principal (cassandra vs dse, etc.).","Fix hostname resolution so serverName matches the host part registered in the KDC (forward/reverse DNS or /etc/hosts).","For cross-realm access, configure trust/capaths in krb5.conf."],"exampleFix":"// before\nserviceName: \"cassandra\" // server keytab holds dse/node1@REALM\n\n// after\nserviceName: \"dse\"","handlingStrategy":"validation","validationCode":"principal := cfg.serviceName + \"/\" + host.Name\n// verify before connecting:\n// kadmin: list_princs | grep cassandra/<host>@REALM\n// or test: kvno cassandra/<host>@REALM","typeGuard":null,"tryCatchPattern":"auth, err := provider(host)\nif err != nil {\n\tvar target string\n\tif strings.Contains(err.Error(), \"get Kerberos service ticket for\") {\n\t\tfmt.Sscanf(err.Error(), \"get Kerberos service ticket for %s\", &target) // log offending principal\n\t}\n\treturn err\n}","preventionTips":["Create service principals for every Cassandra node hostname in the KDC before rollout.","Keep config.serviceName in sync with the server's actual service part (cassandra vs dse).","Ensure forward/reverse DNS matches the hostnames registered in the KDC."],"tags":["kerberos","kdc","service-ticket","network"],"backgroundTag":"kerberos-service-ticket-failed","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}