{"record":{"id":"c764de1dc92edddd","repo":"t8y2/dbx","slug":"cassandra-kerberos-server-does-not-allow-sasl-qop","errorCode":null,"errorMessage":"Cassandra Kerberos server does not allow SASL QOP auth","messagePattern":"Cassandra Kerberos server does not allow SASL QOP auth","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/cassandra-go/kerberos.go","lineNumber":393,"sourceCode":"\theader := append([]byte{kerberosGSSAPITag}, asn1tools.MarshalLengthBytes(len(encodedOID)+len(payload))...)\n\theader = append(header, encodedOID...)\n\treturn append(header, payload...), nil\n}\n\nfunc (authenticator *kerberosAuthenticator) securityLayerResponse(challenge []byte) ([]byte, error) {\n\tvar request gssapi.WrapToken\n\tif err := request.Unmarshal(challenge, true); err != nil {\n\t\treturn nil, fmt.Errorf(\"decode Kerberos SASL security-layer challenge: %w\", err)\n\t}\n\tvalid, err := request.Verify(authenticator.sessionKey, keyusage.GSSAPI_ACCEPTOR_SEAL)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"verify Kerberos SASL security-layer challenge: %w\", err)\n\t}\n\tif !valid {\n\t\treturn nil, fmt.Errorf(\"invalid Kerberos SASL security-layer challenge\")\n\t}\n\tif len(request.Payload) < 4 || request.Payload[0]&kerberosSecurityNone == 0 {\n\t\treturn nil, fmt.Errorf(\"Cassandra Kerberos server does not allow SASL QOP auth\")\n\t}\n\tpayload := []byte{kerberosSecurityNone, 0, 0, 0}\n\tpayload = append(payload, authenticator.authorizationID...)\n\tresponse, err := gssapi.NewInitiatorWrapToken(payload, authenticator.sessionKey)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\treturn response.Marshal()\n}\n\nfunc kerberosAuthenticatorChecksum() []byte {\n\tchecksum := make([]byte, 24)\n\tbinary.LittleEndian.PutUint32(checksum[:4], 16)\n\tflags := uint32(gssapi.ContextFlagInteg | gssapi.ContextFlagConf)\n\tbinary.LittleEndian.PutUint32(checksum[20:24], flags)\n\treturn checksum\n}\n","sourceCodeStart":375,"sourceCodeEnd":411,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/cassandra-go/kerberos.go#L375-L411","documentation":"Returned by securityLayerResponse when the decoded security-layer challenge advertises a SASL QOP list that does not include 'auth'. Cassandra's Kerberos negotiation requires QOP auth (integrity/protection-only configurations are rejected), so a server configured with e.g. only 'auth-int' or 'auth-conf' fails this guard.","triggerScenarios":"Thrown at agents/drivers/cassandra-go/kerberos.go:393 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Configure the Cassandra server's SASL QOP to include 'auth' (e.g. qop=auth in the server's jaas/krb5 SASL settings)","Restart the Cassandra node after changing QOP so new negotiations advertise the updated list"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}