{"record":{"id":"aabe97fdbd420632","repo":"t8y2/dbx","slug":"invalid-kerberos-sasl-security-layer-challenge","errorCode":null,"errorMessage":"invalid Kerberos SASL security-layer challenge","messagePattern":"invalid Kerberos SASL security-layer challenge","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/cassandra-go/kerberos.go","lineNumber":390,"sourceCode":"\tif err != nil {\n\t\treturn nil, err\n\t}\n\theader := append([]byte{kerberosGSSAPITag}, asn1tools.MarshalLengthBytes(len(encodedOID)+len(payload))...)\n\theader = append(header, encodedOID...)\n\treturn append(header, payload...), nil\n}\n\nfunc (authenticator *kerberosAuthenticator) securityLayerResponse(challenge []byte) ([]byte, error) {\n\tvar request gssapi.WrapToken\n\tif err := request.Unmarshal(challenge, true); err != nil {\n\t\treturn nil, fmt.Errorf(\"decode Kerberos SASL security-layer challenge: %w\", err)\n\t}\n\tvalid, err := request.Verify(authenticator.sessionKey, keyusage.GSSAPI_ACCEPTOR_SEAL)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"verify Kerberos SASL security-layer challenge: %w\", err)\n\t}\n\tif !valid {\n\t\treturn nil, fmt.Errorf(\"invalid Kerberos SASL security-layer challenge\")\n\t}\n\tif len(request.Payload) < 4 || request.Payload[0]&kerberosSecurityNone == 0 {\n\t\treturn nil, fmt.Errorf(\"Cassandra Kerberos server does not allow SASL QOP auth\")\n\t}\n\tpayload := []byte{kerberosSecurityNone, 0, 0, 0}\n\tpayload = append(payload, authenticator.authorizationID...)\n\tresponse, err := gssapi.NewInitiatorWrapToken(payload, authenticator.sessionKey)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\treturn response.Marshal()\n}\n\nfunc kerberosAuthenticatorChecksum() []byte {\n\tchecksum := make([]byte, 24)\n\tbinary.LittleEndian.PutUint32(checksum[:4], 16)\n\tflags := uint32(gssapi.ContextFlagInteg | gssapi.ContextFlagConf)\n\tbinary.LittleEndian.PutUint32(checksum[20:24], flags)","sourceCodeStart":372,"sourceCodeEnd":408,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/cassandra-go/kerberos.go#L372-L408","documentation":"Returned by securityLayerResponse when the security-layer challenge token decodes and its checksum verifies, but the embedded token ID/tag is not the expected GSSAPI wrap value — i.e. the token is structurally valid but not a valid acceptor-seal challenge. This is a protocol-shape guard against unexpected token types during Kerberos SASL negotiation.","triggerScenarios":"Thrown at agents/drivers/cassandra-go/kerberos.go:390 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Confirm the server implements the expected GSSAPI security-layer semantics for Cassandra Kerberos auth","Compare the server's SASL implementation version with what the agent expects","Enable Kerberos packet tracing to inspect the token ID actually received"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}