{"record":{"id":"9edf4c8735182635","repo":"t8y2/dbx","slug":"unexpected-cassandra-kerberos-authentication-chall","errorCode":null,"errorMessage":"unexpected Cassandra Kerberos authentication challenge","messagePattern":"unexpected Cassandra Kerberos authentication challenge","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/cassandra-go/kerberos.go","lineNumber":340,"sourceCode":"\nfunc (authenticator *kerberosAuthenticator) Challenge(request []byte) ([]byte, gocql.Authenticator, error) {\n\tswitch authenticator.step {\n\tcase 0:\n\t\ttoken, err := authenticator.initialToken()\n\t\tif err != nil {\n\t\t\treturn nil, nil, err\n\t\t}\n\t\tauthenticator.step = 1\n\t\treturn token, authenticator, nil\n\tcase 1:\n\t\ttoken, err := authenticator.securityLayerResponse(request)\n\t\tif err != nil {\n\t\t\treturn nil, nil, err\n\t\t}\n\t\tauthenticator.step = 2\n\t\treturn token, authenticator, nil\n\tdefault:\n\t\treturn nil, nil, fmt.Errorf(\"unexpected Cassandra Kerberos authentication challenge\")\n\t}\n}\n\nfunc (authenticator *kerberosAuthenticator) Success(_ []byte) error {\n\tif authenticator.step != 2 {\n\t\treturn fmt.Errorf(\"Cassandra reported Kerberos success before SASL negotiation completed\")\n\t}\n\treturn nil\n}\n\nfunc (authenticator *kerberosAuthenticator) initialToken() ([]byte, error) {\n\tvalue, err := types.NewAuthenticator(authenticator.domain, authenticator.clientName)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tvalue.Cksum = types.Checksum{\n\t\tCksumType: chksumtype.GSSAPI,\n\t\tChecksum:  kerberosAuthenticatorChecksum(),","sourceCodeStart":322,"sourceCodeEnd":358,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/cassandra-go/kerberos.go#L322-L358","documentation":"Returned by kerberosAuthenticator.Challenge when the Cassandra server sends an additional authentication challenge after the two-step GSSAPI exchange (initial token + security-layer response) already completed. The SASL state machine only expects challenges at steps 0 and 1; a third challenge indicates a protocol violation or server-side negotiation mismatch.","triggerScenarios":"Thrown at agents/drivers/cassandra-go/kerberos.go:340 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Confirm the Cassandra cluster's SASL/GSSAPI configuration matches what the agent negotiated (Kerberos URI, QOP settings)","Check server logs for repeated or restarted auth negotiations","Verify the krb5 keytab and principal are correct so negotiation completes in the expected two rounds"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}