{"record":{"id":"b37d6768f307f586","repo":"t8y2/dbx","slug":"decode-kerberos-sasl-security-layer-challenge-w","errorCode":null,"errorMessage":"decode Kerberos SASL security-layer challenge: %w","messagePattern":"decode Kerberos SASL security-layer challenge: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/cassandra-go/kerberos.go","lineNumber":383,"sourceCode":"\tbinary.BigEndian.PutUint16(payload, kerberosAPRequestTokenID)\n\tencodedRequest, err := request.Marshal()\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tpayload = append(payload, encodedRequest...)\n\tencodedOID, err := asn1.Marshal(gssapi.OIDKRB5.OID())\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\theader := append([]byte{kerberosGSSAPITag}, asn1tools.MarshalLengthBytes(len(encodedOID)+len(payload))...)\n\theader = append(header, encodedOID...)\n\treturn append(header, payload...), nil\n}\n\nfunc (authenticator *kerberosAuthenticator) securityLayerResponse(challenge []byte) ([]byte, error) {\n\tvar request gssapi.WrapToken\n\tif err := request.Unmarshal(challenge, true); err != nil {\n\t\treturn nil, fmt.Errorf(\"decode Kerberos SASL security-layer challenge: %w\", err)\n\t}\n\tvalid, err := request.Verify(authenticator.sessionKey, keyusage.GSSAPI_ACCEPTOR_SEAL)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"verify Kerberos SASL security-layer challenge: %w\", err)\n\t}\n\tif !valid {\n\t\treturn nil, fmt.Errorf(\"invalid Kerberos SASL security-layer challenge\")\n\t}\n\tif len(request.Payload) < 4 || request.Payload[0]&kerberosSecurityNone == 0 {\n\t\treturn nil, fmt.Errorf(\"Cassandra Kerberos server does not allow SASL QOP auth\")\n\t}\n\tpayload := []byte{kerberosSecurityNone, 0, 0, 0}\n\tpayload = append(payload, authenticator.authorizationID...)\n\tresponse, err := gssapi.NewInitiatorWrapToken(payload, authenticator.sessionKey)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\treturn response.Marshal()","sourceCodeStart":365,"sourceCodeEnd":401,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/cassandra-go/kerberos.go#L365-L401","documentation":"Returned by securityLayerResponse when the GSSAPI WrapToken sent by Cassandra as the SASL security-layer challenge cannot be unmarshalled. The bytes are malformed or not a WrapToken (e.g. wrong token ID, truncated frame, or a server speaking a different encoding); the wrapped error from Unmarshal carries the ASN.1 detail.","triggerScenarios":"Thrown at agents/drivers/cassandra-go/kerberos.go:383 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Check for protocol-version or encoding mismatches between the Cassandra server and the gssapi library used by the agent","Capture the challenge bytes / enable driver logging to confirm whether the server sent a valid WrapToken","Verify the Kerberos QOP configuration on the server (a non-wrap QOP may send a different token shape)"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}