{"record":{"id":"e9994175e067146b","repo":"t8y2/dbx","slug":"cassandra-kerberos-currently-supports-sasl-qop-aut","errorCode":null,"errorMessage":"Cassandra Kerberos currently supports SASL QOP auth only, got %s","messagePattern":"Cassandra Kerberos currently supports SASL QOP auth only, got (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/cassandra-go/kerberos.go","lineNumber":121,"sourceCode":"\t\tconfig.configPath = defaultKerberosConfigPath()\n\t}\n\tpath, err := normalizeLocalFilePath(firstPathListEntry(config.configPath))\n\tif err != nil {\n\t\treturn fmt.Errorf(\"invalid Kerberos config path: %w\", err)\n\t}\n\tconfig.configPath = path\n\tif err := requireRegularFile(\"Kerberos config\", config.configPath); err != nil {\n\t\treturn err\n\t}\n\tkrbConfig, err := krb5config.Load(config.configPath)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"load Kerberos config %s: %w\", config.configPath, err)\n\t}\n\tif config.serviceName == \"\" {\n\t\tconfig.serviceName = \"cassandra\"\n\t}\n\tif !kerberosQOPIncludesAuth(config.qop) {\n\t\treturn fmt.Errorf(\"Cassandra Kerberos currently supports SASL QOP auth only, got %s\", config.qop)\n\t}\n\tconfig.qop = \"auth\"\n\tif config.principal == \"\" {\n\t\tconfig.principal = strings.TrimSpace(username)\n\t}\n\tif config.password == \"\" {\n\t\tconfig.password = password\n\t}\n\tif config.useTicketCache {\n\t\treturn config.selectCCacheCredential()\n\t}\n\tif config.useKeytab {\n\t\treturn config.selectKeytabCredential(krbConfig)\n\t}\n\tif config.ccachePath != \"\" && !config.useTicketCacheSet {\n\t\treturn config.selectCCacheCredential()\n\t}\n\tif config.keytabPath != \"\" && !config.useKeytabSet {","sourceCodeStart":103,"sourceCodeEnd":139,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/cassandra-go/kerberos.go#L103-L139","documentation":"finalize throws this when the configured SASL QOP value does not include \"auth\". The driver implements only QOP level auth (authentication without integrity/privacy); values like auth-int or auth-conf are rejected because the Go implementation does not support SASL integrity or confidentiality layers.","triggerScenarios":"Creating a Kerberos auth provider (newKerberosAuthProvider -> finalize) with qop set to \"auth-int\", \"auth-conf\", \"auth,auth-int\", or any unrecognized value, causing kerberosQOPIncludesAuth to fail.","commonSituations":"Porting a Java Cassandra driver config where sasl.qop=auth-conf was used for encrypted traffic, or combining QOP values with commas as the Java driver allows.","solutions":["Set qop to \"auth\" (or remove it entirely — the default is already \"auth\") and rely on TLS for integrity/privacy instead.","If you need auth-conf/auth-int, enable CQL TLS/SSL on the connection and drop the SASL QOP requirement.","Remove comma-separated QOP lists and use the single value \"auth\"."],"exampleFix":"// before\nconfig.QOP = \"auth-conf\"\n\n// after\nconfig.QOP = \"auth\"","handlingStrategy":"validation","validationCode":"func validateQOP(qop string) error {\n    qop = strings.ToLower(strings.TrimSpace(qop))\n    if qop != \"\" && qop != \"auth\" {\n        return fmt.Errorf(\"only SASL QOP 'auth' is supported, got %q\", qop)\n    }\n    return nil\n}","typeGuard":"func isAuthOnlyQOP(qop string) bool {\n    return strings.ToLower(strings.TrimSpace(qop)) == \"auth\" || qop == \"\"\n}","tryCatchPattern":"if err := cfg.Finalize(user, pass); err != nil {\n    if strings.Contains(err.Error(), \"SASL QOP auth only\") {\n        return fmt.Errorf(\"set qop to 'auth' and use TLS for integrity/privacy: %w\", err)\n    }\n    return err\n}","preventionTips":["Leave qop unset; the driver defaults to \"auth\".","Use CQL TLS instead of SASL auth-int/auth-conf for encryption.","Strip comma-separated QOP lists when porting Java driver configs."],"tags":["kerberos","sasl","qop","unsupported-feature"],"backgroundTag":"unsupported-sasl-qop","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}