{"record":{"id":"ad147552532352c7","repo":"t8y2/dbx","slug":"kerberos-jaas-config-contains-no-krb5loginmodule-ad1475","errorCode":null,"errorMessage":"Kerberos JAAS config contains no Krb5LoginModule","messagePattern":"Kerberos JAAS config contains no Krb5LoginModule","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/hive-go/config.go","lineNumber":969,"sourceCode":"\t}\n\tkerberos.Realm = firstNonEmpty(kerberos.Realm, realmFromPrincipal(kerberos.ClientPrincipal))\n\tif !kerberos.UseTicketCache && !kerberos.UseKeytab && (kerberos.ClientPrincipal == \"\" || kerberos.Password == \"\") {\n\t\treturn errors.New(\"Kerberos requires SSPI, credential cache, keytab, or principal and password\")\n\t}\n\treturn nil\n}\n\nvar jaasOptionPattern = regexp.MustCompile(`(?i)\\b(principal|keytab|ticketcache|usekeytab|useticketcache)\\s*=\\s*(\"(?:\\\\.|[^\"])*\"|'(?:\\\\.|[^'])*'|[^\\s;]+)`)\n\nfunc applyKerberosJAASFile(config *kerberosConfig) error {\n\tcontents, err := os.ReadFile(config.JAASConfigPath)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"read Kerberos JAAS config: %w\", err)\n\t}\n\ttext := string(contents)\n\tmodule := strings.Index(strings.ToLower(text), \"krb5loginmodule\")\n\tif module < 0 {\n\t\treturn errors.New(\"Kerberos JAAS config contains no Krb5LoginModule\")\n\t}\n\tblock := text[module:]\n\tif end := strings.IndexByte(block, ';'); end >= 0 {\n\t\tblock = block[:end]\n\t}\n\tfor _, match := range jaasOptionPattern.FindAllStringSubmatch(block, -1) {\n\t\tkey := strings.ToLower(match[1])\n\t\tvalue := decodeJAASValue(match[2])\n\t\tswitch key {\n\t\tcase \"principal\":\n\t\t\tif config.ClientPrincipal == \"\" {\n\t\t\t\tconfig.ClientPrincipal = value\n\t\t\t}\n\t\tcase \"keytab\":\n\t\t\tif config.KeytabPath == \"\" {\n\t\t\t\tconfig.KeytabPath = value\n\t\t\t}\n\t\tcase \"ticketcache\":","sourceCodeStart":951,"sourceCodeEnd":987,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/hive-go/config.go#L951-L987","documentation":"When parsing a JAAS config file for Kerberos options, the driver scans for the string 'krb5loginmodule' (case-insensitive). If the file does not contain that login module, it cannot extract principal/keytab/ticket-cache options and fails with this error. The JAAS file exists but is not a Kerberos login configuration.","triggerScenarios":"Pointing the Kerberos JAAS config path at a JAAS file whose stanza uses another LoginModule (e.g. Krb5InitCredential, com.sun.security.auth.module other module, LDAP or plain login modules), or a file missing the module entry entirely.","commonSituations":"Reusing a JAAS file intended for Kafka/HDFS with different modules; hand-written JAAS file with a typo like 'Krb5LoginModul'; pointing at the wrong file (e.g. log4j or another config).","solutions":["Add a com.sun.security.auth.module.Krb5LoginModule entry to the JAAS file.","Point the JAAS config path at the correct file containing a Krb5LoginModule stanza.","Fix any typos in the module class name (must contain 'krb5loginmodule' case-insensitively)."],"exampleFix":"// before\notherModule { com.example.OtherModule required; };\n// after\nhiveClient { com.sun.security.auth.module.Krb5LoginModule required principal=\"hive@EXAMPLE.COM\" useKeyTab=true keyTab=\"/etc/security/hive.keytab\"; };","handlingStrategy":"validation","validationCode":"contents, err := os.ReadFile(jaasPath)\nif err != nil { return err }\nif !strings.Contains(strings.ToLower(string(contents)), \"krb5loginmodule\") {\n\treturn fmt.Errorf(\"%s has no Krb5LoginModule\", jaasPath)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Verify JAAS files contain com.sun.security.auth.module.Krb5LoginModule before deployment","Do not reuse JAAS files across different subsystems (Kafka, HDFS, Hive)","Add a startup smoke test that parses the JAAS file"],"tags":["kerberos","jaas","config","authentication"],"backgroundTag":"jaas-missing-krb5loginmodule","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}