{"record":{"id":"a08a8543a36e2b14","repo":"t8y2/dbx","slug":"kerberos-realm-is-required-for-principal-s","errorCode":null,"errorMessage":"Kerberos realm is required for principal %s","messagePattern":"Kerberos realm is required for principal (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/cassandra-go/kerberos.go","lineNumber":562,"sourceCode":"\t}\n\treturn path, nil\n}\n\nfunc splitKerberosPrincipal(principal, configuredRealm, defaultRealm string) (string, string, error) {\n\tvalue := strings.TrimSpace(principal)\n\trealm := strings.TrimSpace(configuredRealm)\n\tif separator := strings.LastIndexByte(value, '@'); separator >= 0 {\n\t\trealm = value[separator+1:]\n\t\tvalue = value[:separator]\n\t}\n\tif value == \"\" {\n\t\treturn \"\", \"\", fmt.Errorf(\"Kerberos principal is empty\")\n\t}\n\tif realm == \"\" {\n\t\trealm = strings.TrimSpace(defaultRealm)\n\t}\n\tif realm == \"\" {\n\t\treturn \"\", \"\", fmt.Errorf(\"Kerberos realm is required for principal %s\", principal)\n\t}\n\treturn value, realm, nil\n}\n\nfunc principalFromKeytab(path string) (string, error) {\n\tloadedKeytab, err := keytab.Load(path)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"load Kerberos keytab %s: %w\", path, err)\n\t}\n\tprincipals := map[string]struct{}{}\n\tfor _, entry := range loadedKeytab.Entries {\n\t\tprincipals[entry.Principal.String()] = struct{}{}\n\t}\n\tif len(principals) != 1 {\n\t\treturn \"\", fmt.Errorf(\"Kerberos keytab %s contains %d principals; configure kerberosprincipal explicitly\", path, len(principals))\n\t}\n\tfor principal := range principals {\n\t\treturn principal, nil","sourceCodeStart":544,"sourceCodeEnd":580,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/cassandra-go/kerberos.go#L544-L580","documentation":"The principal had no '@' realm suffix and no realm could be supplied from the configured realm or the krb5.conf default_realm, so the principal cannot be fully qualified for Kerberos auth. Kerberos requires a realm; the library refuses to guess.","triggerScenarios":"splitKerberosPrincipal receives `svc-cassandra` (no @REALM), configuredRealm is empty, and defaultRealm (from krb5.conf parsing) is also empty — e.g. krb5.conf missing/unreadable or lacking default_realm.","commonSituations":"Short-form principals in configs; krb5.conf not mounted in containers so default_realm is unknown; missing kerberosrealm config option; cross-realm setups where only the short name was given.","solutions":["Include the realm in the principal: svc-cassandra@EXAMPLE.COM.","Set the driver's kerberosrealm config option (or JAAS realm) to EXAMPLE.COM.","Fix /etc/krb5.conf (or KRB5_CONFIG target) to define default_realm = EXAMPLE.COM so the default can be applied.","Confirm the realm matches the KDC's realm, case-sensitive uppercase by convention."],"exampleFix":"// before\nprincipal=\"svc-cassandra\"\n// after\nprincipal=\"svc-cassandra@EXAMPLE.COM\" // or set kerberosrealm=\"EXAMPLE.COM\"","handlingStrategy":"validation","validationCode":"func principalHasRealm(p, configuredRealm string) bool {\n\tif strings.Contains(p, \"@\") { return true }\n\treturn strings.TrimSpace(configuredRealm) != \"\"\n}\n// plus confirm /etc/krb5.conf has default_realm set when relying on the default","typeGuard":"func hasRealm(p string) bool {\n\tat := strings.LastIndexByte(strings.TrimSpace(p), '@')\n\treturn at >= 0 && at < len(p)-1\n}","tryCatchPattern":"if err := client.Finalize(); err != nil {\n\tif strings.Contains(err.Error(), \"realm is required for principal\") {\n\t\tlog.Fatalf(\"qualify principal with @REALM or set kerberosrealm/default_realm\")\n\t}\n\treturn err\n}","preventionTips":["Always use fully qualified principals (user@REALM).","Set kerberosrealm explicitly in the driver config for services.","Ensure krb5.conf with default_realm is present in containers.","Validate realms are uppercase and match the KDC."],"tags":["kerberos","cassandra","principal","realm"],"backgroundTag":"kerberos-principal-invalid","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}