{"record":{"id":"d374a0157fb1cbd5","repo":"t8y2/dbx","slug":"kerberos-jaas-config-contains-no-krb5loginmodule","errorCode":null,"errorMessage":"Kerberos JAAS config contains no Krb5LoginModule","messagePattern":"Kerberos JAAS config contains no Krb5LoginModule","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/argo-go/config.go","lineNumber":966,"sourceCode":"\t}\n\tkerberos.Realm = firstNonEmpty(kerberos.Realm, realmFromPrincipal(kerberos.ClientPrincipal))\n\tif !kerberos.UseTicketCache && !kerberos.UseKeytab && (kerberos.ClientPrincipal == \"\" || kerberos.Password == \"\") {\n\t\treturn errors.New(\"Kerberos requires SSPI, credential cache, keytab, or principal and password\")\n\t}\n\treturn nil\n}\n\nvar jaasOptionPattern = regexp.MustCompile(`(?i)\\b(principal|keytab|ticketcache|usekeytab|useticketcache)\\s*=\\s*(\"(?:\\\\.|[^\"])*\"|'(?:\\\\.|[^'])*'|[^\\s;]+)`)\n\nfunc applyKerberosJAASFile(config *kerberosConfig) error {\n\tcontents, err := os.ReadFile(config.JAASConfigPath)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"read Kerberos JAAS config: %w\", err)\n\t}\n\ttext := string(contents)\n\tmodule := strings.Index(strings.ToLower(text), \"krb5loginmodule\")\n\tif module < 0 {\n\t\treturn errors.New(\"Kerberos JAAS config contains no Krb5LoginModule\")\n\t}\n\tblock := text[module:]\n\tif end := strings.IndexByte(block, ';'); end >= 0 {\n\t\tblock = block[:end]\n\t}\n\tfor _, match := range jaasOptionPattern.FindAllStringSubmatch(block, -1) {\n\t\tkey := strings.ToLower(match[1])\n\t\tvalue := decodeJAASValue(match[2])\n\t\tswitch key {\n\t\tcase \"principal\":\n\t\t\tif config.ClientPrincipal == \"\" {\n\t\t\t\tconfig.ClientPrincipal = value\n\t\t\t}\n\t\tcase \"keytab\":\n\t\t\tif config.KeytabPath == \"\" {\n\t\t\t\tconfig.KeytabPath = value\n\t\t\t}\n\t\tcase \"ticketcache\":","sourceCodeStart":948,"sourceCodeEnd":984,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/argo-go/config.go#L948-L984","documentation":"When a JAAS config path is configured for Kerberos, applyKerberosJAASFile reads the file and scans it for a Krb5LoginModule entry, since only that module carries the principal/keytab/ticketCache options this driver understands. If the file text does not contain the string \"krb5loginmodule\" (case-insensitive), the file is not usable for Kerberos and this error is thrown. Note the module must appear before any ';' character for its options to be parsed.","triggerScenarios":"Pointing kerberos.JAASConfigPath (or -Djava.security.auth.login.config via JVM options) at a JAAS file that defines other login modules (e.g. com.sun.security.auth.module.UnixLoginModule, LdapLoginModule) but no com.sun.security.auth.module.Krb5LoginModule; a typo like 'Krb5Loginmodule' still matches due to case-insensitivity, so mostly this means the wrong file or a placeholder file was supplied.","commonSituations":"Reusing a JAAS file from a non-Kerberos service; copying a template with the Krb5LoginModule block commented out or not yet filled in; passing the wrong path (e.g. a krb5.conf instead of jaas.conf); empty or truncated JAAS file.","solutions":["Edit the JAAS file to include a Krb5LoginModule entry, e.g. 'Client { com.sun.security.auth.module.Krb5LoginModule required useKeyTab=true keyTab=\"/path/keytab\" principal=\"user@REALM\"; };'.","Verify the JAASConfigPath points to the intended jaas.conf, not krb5.conf or another config file.","Ensure the Krb5LoginModule block is not commented out and its text appears before the terminating ';'."],"exampleFix":"// before (jaas.conf)\nClient { com.sun.security.auth.module.UnixLoginModule required; };\n// after\nClient { com.sun.security.auth.module.Krb5LoginModule required useKeyTab=true keyTab=\"/etc/security/keytabs/hive.keytab\" principal=\"hive@EXAMPLE.COM\"; };","handlingStrategy":"validation","validationCode":"func validateJAASFile(path string) error {\n\tb, err := os.ReadFile(path)\n\tif err != nil { return err }\n\tif !strings.Contains(strings.ToLower(string(b)), \"krb5loginmodule\") {\n\t\treturn fmt.Errorf(\"%s has no Krb5LoginModule block\", path)\n\t}\n\treturn nil\n}\n// call before setting JAASConfigPath","typeGuard":null,"tryCatchPattern":"if err := driver.Connect(cfg); err != nil {\n\tif strings.Contains(err.Error(), \"no Krb5LoginModule\") {\n\t\treturn fmt.Errorf(\"JAAS file %s is not a Kerberos JAAS config: %w\", jaasPath, err)\n\t}\n\treturn err\n}","preventionTips":["Keep jaas.conf and krb5.conf as distinct files with obvious names; never cross-wire their paths.","Include the full 'com.sun.security.auth.module.Krb5LoginModule required ...;' block in templates.","Ensure the Krb5LoginModule block is not commented out and ends with ';' after its options.","Validate the JAAS file in CI or at startup with a simple substring check."],"tags":["kerberos","jaas","config"],"backgroundTag":"missing-krb5-login-module","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}