{"record":{"id":"d69eede3183a3534","repo":"t8y2/dbx","slug":"kerberos-requires-krb5-conf-or-windows-sspi-d69eed","errorCode":null,"errorMessage":"Kerberos requires krb5.conf or Windows SSPI","messagePattern":"Kerberos requires krb5\\.conf or Windows SSPI","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/hive-go/config.go","lineNumber":941,"sourceCode":"\tif kerberos.ConfigPath == \"\" {\n\t\tif candidate := defaultKerberosConfigPath(); fileExists(candidate) {\n\t\t\tkerberos.ConfigPath = candidate\n\t\t}\n\t}\n\tif !kerberos.UseTicketCache && kerberos.CCachePath == \"\" {\n\t\tif candidate := defaultKerberosCCachePath(); fileExists(candidate) {\n\t\t\tkerberos.CCachePath = candidate\n\t\t\tkerberos.UseTicketCache = true\n\t\t}\n\t}\n\tif runtime.GOOS == \"windows\" && kerberos.ConfigPath == \"\" && kerberos.KeytabPath == \"\" && kerberos.CCachePath == \"\" {\n\t\tkerberos.UseSSPI = true\n\t}\n\tif kerberos.UseSSPI {\n\t\treturn nil\n\t}\n\tif kerberos.ConfigPath == \"\" {\n\t\treturn errors.New(\"Kerberos requires krb5.conf or Windows SSPI\")\n\t}\n\tif kerberos.ClientPrincipal == \"\" && !kerberos.UseTicketCache && !kerberos.UseKeytab {\n\t\tkerberos.ClientPrincipal = strings.TrimSpace(config.Username)\n\t}\n\tif kerberos.KeytabPath != \"\" {\n\t\tkerberos.UseKeytab = true\n\t}\n\tif kerberos.CCachePath != \"\" {\n\t\tkerberos.UseTicketCache = true\n\t}\n\tkerberos.Realm = firstNonEmpty(kerberos.Realm, realmFromPrincipal(kerberos.ClientPrincipal))\n\tif !kerberos.UseTicketCache && !kerberos.UseKeytab && (kerberos.ClientPrincipal == \"\" || kerberos.Password == \"\") {\n\t\treturn errors.New(\"Kerberos requires SSPI, credential cache, keytab, or principal and password\")\n\t}\n\treturn nil\n}\n\nvar jaasOptionPattern = regexp.MustCompile(`(?i)\\b(principal|keytab|ticketcache|usekeytab|useticketcache)\\s*=\\s*(\"(?:\\\\.|[^\"])*\"|'(?:\\\\.|[^'])*'|[^\\s;]+)`)","sourceCodeStart":923,"sourceCodeEnd":959,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/hive-go/config.go#L923-L959","documentation":"During Kerberos configuration validation, if SSPI is not enabled (Windows-only) and no krb5.conf path was supplied, the driver cannot initialize Kerberos and rejects the config. Kerberos needs either the MIT krb5 configuration file (non-Windows or explicit path) or the Windows SSPI path. This is a config-completeness check thrown before any network connection is attempted.","triggerScenarios":"Building a Hive config with kerberos auth enabled but leaving kerberos.ConfigPath empty while kerberos.UseSSPI is false — e.g. running on Linux with no KRB5_CONFIG-derived ConfigPath set.","commonSituations":"Deploying to Linux after developing on Windows where SSPI was used implicitly; forgetting to ship krb5.conf with the container; ConfigPath pointing to a value only set via env var that is not propagated.","solutions":["Set kerberos.ConfigPath to a valid krb5.conf path (e.g. /etc/krb5.conf).","On Windows, set kerberos.UseSSPI = true to use integrated Windows authentication.","Ship a krb5.conf in the container/image and point ConfigPath at it, or set the KRB5_CONFIG convention path."],"exampleFix":"// before\nkerberos := &KerberosConfig{ClientPrincipal: \"hive@EXAMPLE.COM\"}\n// after\nkerberos := &KerberosConfig{ConfigPath: \"/etc/krb5.conf\", ClientPrincipal: \"hive@EXAMPLE.COM\"}","handlingStrategy":"validation","validationCode":"if kerberos.UseSSPI == false && kerberos.ConfigPath == \"\" {\n\treturn fmt.Errorf(\"set kerberos.ConfigPath to a krb5.conf before connecting\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Fail fast at app startup by validating Kerberos config before opening connections","Set KRB5_CONFIG or ship krb5.conf in every deployment image","Document the Windows-SSPI vs krb5.conf platform difference in team runbooks"],"tags":["kerberos","config","authentication"],"backgroundTag":"kerberos-config-incomplete","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}