{"record":{"id":"b833ef7804634aed","repo":"t8y2/dbx","slug":"verify-kerberos-sasl-security-layer-challenge-w","errorCode":null,"errorMessage":"verify Kerberos SASL security-layer challenge: %w","messagePattern":"verify Kerberos SASL security-layer challenge: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/cassandra-go/kerberos.go","lineNumber":387,"sourceCode":"\t}\n\tpayload = append(payload, encodedRequest...)\n\tencodedOID, err := asn1.Marshal(gssapi.OIDKRB5.OID())\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\theader := append([]byte{kerberosGSSAPITag}, asn1tools.MarshalLengthBytes(len(encodedOID)+len(payload))...)\n\theader = append(header, encodedOID...)\n\treturn append(header, payload...), nil\n}\n\nfunc (authenticator *kerberosAuthenticator) securityLayerResponse(challenge []byte) ([]byte, error) {\n\tvar request gssapi.WrapToken\n\tif err := request.Unmarshal(challenge, true); err != nil {\n\t\treturn nil, fmt.Errorf(\"decode Kerberos SASL security-layer challenge: %w\", err)\n\t}\n\tvalid, err := request.Verify(authenticator.sessionKey, keyusage.GSSAPI_ACCEPTOR_SEAL)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"verify Kerberos SASL security-layer challenge: %w\", err)\n\t}\n\tif !valid {\n\t\treturn nil, fmt.Errorf(\"invalid Kerberos SASL security-layer challenge\")\n\t}\n\tif len(request.Payload) < 4 || request.Payload[0]&kerberosSecurityNone == 0 {\n\t\treturn nil, fmt.Errorf(\"Cassandra Kerberos server does not allow SASL QOP auth\")\n\t}\n\tpayload := []byte{kerberosSecurityNone, 0, 0, 0}\n\tpayload = append(payload, authenticator.authorizationID...)\n\tresponse, err := gssapi.NewInitiatorWrapToken(payload, authenticator.sessionKey)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\treturn response.Marshal()\n}\n\nfunc kerberosAuthenticatorChecksum() []byte {\n\tchecksum := make([]byte, 24)","sourceCodeStart":369,"sourceCodeEnd":405,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/cassandra-go/kerberos.go#L369-L405","documentation":"Returned by securityLayerResponse when the SASL security-layer challenge WrapToken decodes but fails cryptographic verification with the negotiated Kerberos session key (keyusage GSSAPI_ACCEPTOR_SEAL). This typically means the session key differs on the two sides — e.g. mismatched enctypes, tickets from different KDCs, or corrupted token bytes.","triggerScenarios":"Thrown at agents/drivers/cassandra-go/kerberos.go:387 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Ensure agent and Cassandra server use the same KDC realm and enctypes (check permitted enctypes in krb5.conf)","Regenerate keytabs if keys were recently rotated","Verify clocks and KDC health so both sides derive the same session key","Confirm no intermediary is altering the SASL payload"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}