{"record":{"id":"d237a9dc2412aeeb","repo":"t8y2/dbx","slug":"kerberos-authentication-requires-a-credential-cach","errorCode":null,"errorMessage":"Kerberos authentication requires a credential cache, keytab, or principal and password","messagePattern":"Kerberos authentication requires a credential cache, keytab, or principal and password","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/cassandra-go/kerberos.go","lineNumber":174,"sourceCode":"\t\tif config.ccachePath == \"\" {\n\t\t\tdefaultCache := defaultKerberosCCachePath()\n\t\t\tif path, normalizeErr := normalizeKerberosCachePath(defaultCache); normalizeErr == nil {\n\t\t\t\tif info, statErr := os.Stat(path); statErr == nil && info.Mode().IsRegular() {\n\t\t\t\t\tconfig.ccachePath = defaultCache\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t\tif config.ccachePath != \"\" {\n\t\t\treturn config.selectCCacheCredential()\n\t\t}\n\t}\n\tif !config.useKeytabSet {\n\t\tconfig.keytabPath = firstNonEmpty(os.Getenv(\"KRB5_CLIENT_KTNAME\"), os.Getenv(\"KRB5_KTNAME\"))\n\t\tif config.keytabPath != \"\" {\n\t\t\treturn config.selectKeytabCredential(krbConfig)\n\t\t}\n\t}\n\treturn fmt.Errorf(\"Kerberos authentication requires a credential cache, keytab, or principal and password\")\n}\n\nfunc (config *kerberosConfig) selectCCacheCredential() error {\n\tvar err error\n\tif config.ccachePath == \"\" {\n\t\tconfig.ccachePath = defaultKerberosCCachePath()\n\t}\n\tconfig.ccachePath, err = normalizeKerberosCachePath(config.ccachePath)\n\tif err != nil {\n\t\treturn err\n\t}\n\tif err := requireRegularFile(\"Kerberos credential cache\", config.ccachePath); err != nil {\n\t\treturn err\n\t}\n\tconfig.credentialMode = kerberosCredentialCCache\n\treturn nil\n}\n","sourceCodeStart":156,"sourceCodeEnd":192,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/cassandra-go/kerberos.go#L156-L192","documentation":"This error comes from kerberosConfig.finalize in the cassandra-go driver. After Kerberos is enabled, finalize tries in order: explicit ticket cache, explicit keytab, ccache path, keytab path, principal+password, then KRB5CCNAME/default cache, then KRB5_CLIENT_KTNAME/KRB5_KTNAME. If none of these yields usable credentials, it refuses to build an authenticator because gocql Kerberos auth needs some credential source to authenticate to Cassandra.","triggerScenarios":"Calling newKerberosAuthProvider (via clusterConfig) with config.enabled=true but: useTicketCache/useKeytab false or their selected paths empty, ccachePath and keytabPath unset, principal or password empty, KRB5CCNAME unset with no default cache file at /tmp/krb5cc_<uid>, and KRB5_CLIENT_KTNAME/KRB5_KTNAME unset.","commonSituations":"Running the app in a container or CI where no kinit was performed and no keytab was mounted; having only KRB5_CONFIG set but no credential material; setting a principal without a password and no cache/keytab; stale KRB5CCNAME pointing nowhere.","solutions":["Provide credentials: run `kinit user@REALM` (or ensure KRB5CCNAME points to a valid ccache) before starting the process.","Set useKeytab=true and keytabPath (or export KRB5_CLIENT_KTNAME) pointing to an existing keytab file.","Pass both principal (e.g. user@REALM) and password through the driver username/password so finalize takes the password credential path.","Verify with `klist` and check env vars KRB5CCNAME, KRB5_CLIENT_KTNAME, KRB5_KTNAME are visible to the process."],"exampleFix":"// before (no credential source found)\nclusterConfig(kerberosConfig{enabled: true})\n\n// after (explicit keytab)\nclusterConfig(kerberosConfig{enabled: true, useKeytab: true, keytabPath: \"/etc/security/cassandra.keytab\", principal: \"cassandra@EXAMPLE.COM\"})","handlingStrategy":"validation","validationCode":"func kerberosCredsAvailable() error {\n\tif os.Getenv(\"KRB5CCNAME\") != \"\" { return nil }\n\tif _, err := os.Stat(defaultCCachePath()); err == nil { return nil }\n\tif p := firstNonEmpty(os.Getenv(\"KRB5_CLIENT_KTNAME\"), os.Getenv(\"KRB5_KTNAME\")); p != \"\" {\n\t\tif _, err := os.Stat(p); err == nil { return nil }\n\t}\n\treturn errors.New(\"no Kerberos ccache or keytab; run kinit or set a keytab path\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Run kinit (or use a keytab with k5start/krb5-auth-dialog) as a startup dependency of the service.","In containers, mount the keytab and set KRB5_CLIENT_KTNAME explicitly instead of relying on ambient caches.","Smoke-test `klist` in your readiness probe or entrypoint before connecting."],"tags":["kerberos","authentication","configuration","golang"],"backgroundTag":"missing-kerberos-credentials","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}