{"record":{"id":"75ba985109f7e4bc","repo":"t8y2/dbx","slug":"kerberos-requires-sspi-credential-cache-keytab-75ba98","errorCode":null,"errorMessage":"Kerberos requires SSPI, credential cache, keytab, or principal and password","messagePattern":"Kerberos requires SSPI, credential cache, keytab, or principal and password","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/hive-go/config.go","lineNumber":954,"sourceCode":"\t}\n\tif kerberos.UseSSPI {\n\t\treturn nil\n\t}\n\tif kerberos.ConfigPath == \"\" {\n\t\treturn errors.New(\"Kerberos requires krb5.conf or Windows SSPI\")\n\t}\n\tif kerberos.ClientPrincipal == \"\" && !kerberos.UseTicketCache && !kerberos.UseKeytab {\n\t\tkerberos.ClientPrincipal = strings.TrimSpace(config.Username)\n\t}\n\tif kerberos.KeytabPath != \"\" {\n\t\tkerberos.UseKeytab = true\n\t}\n\tif kerberos.CCachePath != \"\" {\n\t\tkerberos.UseTicketCache = true\n\t}\n\tkerberos.Realm = firstNonEmpty(kerberos.Realm, realmFromPrincipal(kerberos.ClientPrincipal))\n\tif !kerberos.UseTicketCache && !kerberos.UseKeytab && (kerberos.ClientPrincipal == \"\" || kerberos.Password == \"\") {\n\t\treturn errors.New(\"Kerberos requires SSPI, credential cache, keytab, or principal and password\")\n\t}\n\treturn nil\n}\n\nvar jaasOptionPattern = regexp.MustCompile(`(?i)\\b(principal|keytab|ticketcache|usekeytab|useticketcache)\\s*=\\s*(\"(?:\\\\.|[^\"])*\"|'(?:\\\\.|[^'])*'|[^\\s;]+)`)\n\nfunc applyKerberosJAASFile(config *kerberosConfig) error {\n\tcontents, err := os.ReadFile(config.JAASConfigPath)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"read Kerberos JAAS config: %w\", err)\n\t}\n\ttext := string(contents)\n\tmodule := strings.Index(strings.ToLower(text), \"krb5loginmodule\")\n\tif module < 0 {\n\t\treturn errors.New(\"Kerberos JAAS config contains no Krb5LoginModule\")\n\t}\n\tblock := text[module:]\n\tif end := strings.IndexByte(block, ';'); end >= 0 {","sourceCodeStart":936,"sourceCodeEnd":972,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/hive-go/config.go#L936-L972","documentation":"Final Kerberos validation: after realm/principal defaults are applied, the driver requires at least one usable credential mechanism — SSPI, a ticket cache (CCache), a keytab, or an explicit principal plus password. If none is present it rejects the config with this error.","triggerScenarios":"Enabling Kerberos auth with a ConfigPath set but leaving UseSSPI=false, UseTicketCache=false, UseKeytab=false, and either ClientPrincipal or Password empty.","commonSituations":"Interactive login style copied to a headless service without keytab/password; assuming ticket cache exists but KRB5CCNAME is unset and CCachePath empty; password stored in a secret manager but never populated into config.","solutions":["Set kerberos.ClientPrincipal and kerberos.Password for principal/password auth.","Set kerberos.KeytabPath (which forces UseKeytab) for headless keytab auth.","Set kerberos.CCachePath or UseTicketCache = true to use an existing credential cache.","On Windows, set kerberos.UseSSPI = true."],"exampleFix":"// before\nkerberos := &KerberosConfig{ConfigPath: \"/etc/krb5.conf\"}\n// after\nkerberos := &KerberosConfig{ConfigPath: \"/etc/krb5.conf\", KeytabPath: \"/etc/security/hive.keytab\", ClientPrincipal: \"hive@EXAMPLE.COM\"}","handlingStrategy":"validation","validationCode":"if !kerberos.UseSSPI && !kerberos.UseTicketCache && !kerberos.UseKeytab &&\n\t(kerberos.ClientPrincipal == \"\" || kerberos.Password == \"\") {\n\treturn fmt.Errorf(\"Kerberos needs SSPI, ticket cache, keytab, or principal+password\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["For services, always prefer keytab auth; for workstations, SSPI or ticket cache (kinit)","Validate the credential combination at config-load time","Keep secrets (passwords) out of plain config; inject them from a secret manager"],"tags":["kerberos","config","authentication"],"backgroundTag":"kerberos-config-incomplete","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}