{"record":{"id":"d3dd05e7e5abde3b","repo":"t8y2/dbx","slug":"kerberos-requires-krb5-conf-or-windows-sspi","errorCode":null,"errorMessage":"Kerberos requires krb5.conf or Windows SSPI","messagePattern":"Kerberos requires krb5\\.conf or Windows SSPI","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/argo-go/config.go","lineNumber":938,"sourceCode":"\tif kerberos.ConfigPath == \"\" {\n\t\tif candidate := defaultKerberosConfigPath(); fileExists(candidate) {\n\t\t\tkerberos.ConfigPath = candidate\n\t\t}\n\t}\n\tif !kerberos.UseTicketCache && kerberos.CCachePath == \"\" {\n\t\tif candidate := defaultKerberosCCachePath(); fileExists(candidate) {\n\t\t\tkerberos.CCachePath = candidate\n\t\t\tkerberos.UseTicketCache = true\n\t\t}\n\t}\n\tif runtime.GOOS == \"windows\" && kerberos.ConfigPath == \"\" && kerberos.KeytabPath == \"\" && kerberos.CCachePath == \"\" {\n\t\tkerberos.UseSSPI = true\n\t}\n\tif kerberos.UseSSPI {\n\t\treturn nil\n\t}\n\tif kerberos.ConfigPath == \"\" {\n\t\treturn errors.New(\"Kerberos requires krb5.conf or Windows SSPI\")\n\t}\n\tif kerberos.ClientPrincipal == \"\" && !kerberos.UseTicketCache && !kerberos.UseKeytab {\n\t\tkerberos.ClientPrincipal = strings.TrimSpace(config.Username)\n\t}\n\tif kerberos.KeytabPath != \"\" {\n\t\tkerberos.UseKeytab = true\n\t}\n\tif kerberos.CCachePath != \"\" {\n\t\tkerberos.UseTicketCache = true\n\t}\n\tkerberos.Realm = firstNonEmpty(kerberos.Realm, realmFromPrincipal(kerberos.ClientPrincipal))\n\tif !kerberos.UseTicketCache && !kerberos.UseKeytab && (kerberos.ClientPrincipal == \"\" || kerberos.Password == \"\") {\n\t\treturn errors.New(\"Kerberos requires SSPI, credential cache, keytab, or principal and password\")\n\t}\n\treturn nil\n}\n\nvar jaasOptionPattern = regexp.MustCompile(`(?i)\\b(principal|keytab|ticketcache|usekeytab|useticketcache)\\s*=\\s*(\"(?:\\\\.|[^\"])*\"|'(?:\\\\.|[^'])*'|[^\\s;]+)`)","sourceCodeStart":920,"sourceCodeEnd":956,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/argo-go/config.go#L920-L956","documentation":"When Kerberos authentication is enabled (kerberos.Enabled), the driver needs a way to obtain Kerberos credentials. On non-Windows platforms it requires a krb5.conf configuration file path (explicitly set, via KRB5_CONFIG, or found at a default location). If no config path was resolved and SSPI (Windows integrated auth) is not enabled, configuration cannot proceed and this error is thrown from finalizeKerberosConfig.","triggerScenarios":"Enabling Kerberos auth in the connection config on Linux/macOS without: a ConfigPath, a KRB5_CONFIG environment variable, a krb5.conf at the default location (/etc/krb5.conf etc.), or kerberos.UseSSPI on Windows.","commonSituations":"Running in a minimal Docker image (scratch/alpine) that lacks /etc/krb5.conf; forgetting to mount or copy krb5.conf into the container; KRB5_CONFIG pointing to a missing file; enabling kerberos=true in a connection string on a machine without any Kerberos setup.","solutions":["Install or mount a valid krb5.conf and set kerberos.ConfigPath (or KRB5_CONFIG) to its path.","Set the KRB5_CONFIG environment variable to the krb5.conf location before starting the process.","On Windows, confirm the code path allows SSPI, or explicitly set kerberos.UseSSPI = true.","In containers, add the krb5.conf file (e.g. COPY krb5.conf /etc/krb5.conf) and install krb5 userland packages."],"exampleFix":"// before\ncfg := map[string]string{\"authentication\": \"kerberos\"}\n// after\ncfg := map[string]string{\"authentication\": \"kerberos\", \"kerberosConfigPath\": \"/etc/krb5.conf\"}\n// or: os.Setenv(\"KRB5_CONFIG\", \"/etc/krb5.conf\")","handlingStrategy":"validation","validationCode":"func ensureKrb5Setup(useSSPI bool, configPath, envKrb5 string) error {\n\tif runtime.GOOS == \"windows\" && useSSPI { return nil }\n\tif configPath != \"\" {\n\t\tif _, err := os.Stat(configPath); err != nil { return fmt.Errorf(\"krb5.conf not found: %w\", err) }\n\t\treturn nil\n\t}\n\tif envKrb5 != \"\" {\n\t\tif _, err := os.Stat(envKrb5); err != nil { return fmt.Errorf(\"KRB5_CONFIG points to missing file: %w\", err) }\n\t\treturn nil\n\t}\n\tfor _, p := range []string{\"/etc/krb5.conf\", \"/etc/krb5/krb5.conf\"} {\n\t\tif _, err := os.Stat(p); err == nil { return nil }\n\t}\n\treturn errors.New(\"no krb5.conf available; set KRB5_CONFIG or kerberosConfigPath\")\n}\n// call before enabling kerberos auth","typeGuard":null,"tryCatchPattern":"if err := driver.Connect(cfg); err != nil {\n\tif strings.Contains(err.Error(), \"requires krb5.conf\") {\n\t\treturn fmt.Errorf(\"kerberos setup incomplete: install krb5.conf or set KRB5_CONFIG: %w\", err)\n\t}\n\treturn err\n}","preventionTips":["Bake krb5.conf into container images (COPY krb5.conf /etc/krb5.conf).","Set KRB5_CONFIG explicitly in deployment manifests.","Stat the config file at service startup, before connecting.","On Windows prefer SSPI and skip Linux-only checks."],"tags":["kerberos","config","krb5","environment"],"backgroundTag":"missing-krb5-conf","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}