{"record":{"id":"6885118b9d852044","repo":"t8y2/dbx","slug":"kerberos-login-failed-w","errorCode":null,"errorMessage":"Kerberos login failed: %w","messagePattern":"Kerberos login failed: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/cassandra-go/kerberos.go","lineNumber":259,"sourceCode":"\t\treturn nil, fmt.Errorf(\"load Kerberos config %s: %w\", config.configPath, err)\n\t}\n\treturn func(host *gocql.HostInfo) (gocql.Authenticator, error) {\n\t\treturn newKerberosAuthenticator(config, krbConfig, host)\n\t}, nil\n}\n\nfunc newKerberosAuthenticator(\n\tconfig kerberosConfig,\n\tkrbConfig *krb5config.Config,\n\thost *gocql.HostInfo,\n) (gocql.Authenticator, error) {\n\tclient, err := newKerberosClient(config, krbConfig)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tif err := client.Login(); err != nil {\n\t\tclient.Destroy()\n\t\treturn nil, fmt.Errorf(\"Kerberos login failed: %w\", err)\n\t}\n\tserverName, err := kerberosServerName(config, host)\n\tif err != nil {\n\t\tclient.Destroy()\n\t\treturn nil, err\n\t}\n\tservicePrincipal := config.serviceName + \"/\" + serverName\n\tticket, sessionKey, err := client.GetServiceTicket(servicePrincipal)\n\tif err != nil {\n\t\tclient.Destroy()\n\t\treturn nil, fmt.Errorf(\"get Kerberos service ticket for %s: %w\", servicePrincipal, err)\n\t}\n\tclientName := client.Credentials.CName()\n\tclientName.NameString = append([]string(nil), clientName.NameString...)\n\tauthenticator := &kerberosAuthenticator{\n\t\tdomain:          strings.Clone(client.Credentials.Domain()),\n\t\tclientName:      clientName,\n\t\tticket:          ticket,","sourceCodeStart":241,"sourceCodeEnd":277,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/cassandra-go/kerberos.go#L241-L277","documentation":"newKerberosAuthenticator creates a krb5 client and performs the Kerberos login (obtaining initial credentials from the ccache, keytab, or password). If client.Login() fails, the client is destroyed and the underlying go-krb5 error (pre-auth failure, clock skew, KDC unreachable, bad keytab entry) is wrapped with this message.","triggerScenarios":"Any failure of krb5client.Login() at authentication time: wrong password for the principal, keytab entry not matching the principal/enctype, KDC unreachable, clock skew beyond allowed skew, expired/bad ccache credentials.","commonSituations":"Keytab extracted for the wrong principal; password rotated after deployment; container clock drift causing 'clock skew too great'; KDC/DNS misconfiguration (cannot resolve realm KDC).","solutions":["Inspect the wrapped cause: fix clock skew (`ntpdate`/chrony), KDC reachability (DNS SRV, /etc/krb5.conf realms), or credentials accordingly.","Re-extract the keytab on the KDC (`ktadd`) for the exact principal in use, or re-run kinit with the correct password.","Test outside the app: `kinit -kt /path/keytab principal@REALM` to isolate the failure.","Ensure the ccache (if used) holds fresh tickets (`klist -f`), re-run `kinit` if expired."],"exampleFix":"// before: stale keytab entry\n// after: re-extract matching principal\n// on KDC: kadmin: ktadd -k /etc/security/cassandra.keytab cassandra/host@REALM","handlingStrategy":"retry","validationCode":"// preflight outside the app path:\n// kinit -kt $KEYTAB $PRINCIPAL || echo \"keytab login failed\"\n// chronyc tracking | grep -i offset  # keep skew < 5 min","typeGuard":null,"tryCatchPattern":"provider, err := newKerberosAuthProvider(cfg, user, pass)\nif err != nil {\n\tif strings.Contains(err.Error(), \"login failed\") {\n\t\t// inspect wrapped cause: clock skew, KDC unreachable, bad key => alert, backoff, retry\n\t}\n\treturn err\n}","preventionTips":["Run NTP/chrony on all hosts to avoid clock-skew rejections.","Rotate keytabs by re-extracting on the KDC before passwords expire.","Monitor KDC availability and DNS resolution of realm KDCs from the client network."],"tags":["kerberos","kdc","authentication","login-failed"],"backgroundTag":"kerberos-login-failed","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}