{"record":{"id":"f95297d147a5b25f","repo":"t8y2/dbx","slug":"kerberos-requires-sspi-credential-cache-keytab","errorCode":null,"errorMessage":"Kerberos requires SSPI, credential cache, keytab, or principal and password","messagePattern":"Kerberos requires SSPI, credential cache, keytab, or principal and password","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/argo-go/config.go","lineNumber":951,"sourceCode":"\t}\n\tif kerberos.UseSSPI {\n\t\treturn nil\n\t}\n\tif kerberos.ConfigPath == \"\" {\n\t\treturn errors.New(\"Kerberos requires krb5.conf or Windows SSPI\")\n\t}\n\tif kerberos.ClientPrincipal == \"\" && !kerberos.UseTicketCache && !kerberos.UseKeytab {\n\t\tkerberos.ClientPrincipal = strings.TrimSpace(config.Username)\n\t}\n\tif kerberos.KeytabPath != \"\" {\n\t\tkerberos.UseKeytab = true\n\t}\n\tif kerberos.CCachePath != \"\" {\n\t\tkerberos.UseTicketCache = true\n\t}\n\tkerberos.Realm = firstNonEmpty(kerberos.Realm, realmFromPrincipal(kerberos.ClientPrincipal))\n\tif !kerberos.UseTicketCache && !kerberos.UseKeytab && (kerberos.ClientPrincipal == \"\" || kerberos.Password == \"\") {\n\t\treturn errors.New(\"Kerberos requires SSPI, credential cache, keytab, or principal and password\")\n\t}\n\treturn nil\n}\n\nvar jaasOptionPattern = regexp.MustCompile(`(?i)\\b(principal|keytab|ticketcache|usekeytab|useticketcache)\\s*=\\s*(\"(?:\\\\.|[^\"])*\"|'(?:\\\\.|[^'])*'|[^\\s;]+)`)\n\nfunc applyKerberosJAASFile(config *kerberosConfig) error {\n\tcontents, err := os.ReadFile(config.JAASConfigPath)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"read Kerberos JAAS config: %w\", err)\n\t}\n\ttext := string(contents)\n\tmodule := strings.Index(strings.ToLower(text), \"krb5loginmodule\")\n\tif module < 0 {\n\t\treturn errors.New(\"Kerberos JAAS config contains no Krb5LoginModule\")\n\t}\n\tblock := text[module:]\n\tif end := strings.IndexByte(block, ';'); end >= 0 {","sourceCodeStart":933,"sourceCodeEnd":969,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/argo-go/config.go#L933-L969","documentation":"With Kerberos enabled, the driver must end up with at least one usable credential source: Windows SSPI, a ticket cache (UseTicketCache/CCachePath), a keytab (UseKeytab/KeytabPath), or an explicit client principal plus password. If none of these are satisfied after applying JAAS files, environment variables (KRB5CCNAME, KRB5_CLIENT_KTNAME), and defaults, finalizeKerberosConfig returns this error. This mirrors the Java Hive JDBC driver's requirement that a UGI login has some credential mechanism.","triggerScenarios":"Enabling Kerberos with a krb5.conf present but no principal, no password, no keytab, and no ccache — e.g. config.Username empty and no UseTicketCache/UseKeytab flags, and the JAAS config (if any) provided no principal/keytab/ticketCache options.","commonSituations":"Setting kerberos=true but forgetting kinit (no ~/krb5cc cache exists) on a service account without a keytab; JAAS file present but with a non-Krb5 module so no options were extracted; username empty because auth was expected to come purely from the environment; migration from password auth where Password was cleared.","solutions":["Run kinit (or ensure KRB5CCNAME points to a valid ccache) so the driver can use the ticket cache.","Provide a keytab: set kerberos.KeytabPath (or KRB5_CLIENT_KTNAME) with a keytab for the client principal.","Set both a client principal (config.Username, e.g. user@REALM) and password in the config.","Add principal/keytab/ticketCache options to the Krb5LoginModule block in the JAAS config file.","On Windows, use SSPI (leave other options unset on a domain-joined machine)."],"exampleFix":"// before\nkcfg := kerberosConfig{Enabled: true} // no credentials anywhere\n// after\nkcfg := kerberosConfig{Enabled: true, KeytabPath: \"/etc/security/keytabs/client.keytab\", ClientPrincipal: \"hive@EXAMPLE.COM\"}\n// or run: kinit hive@EXAMPLE.COM","handlingStrategy":"validation","validationCode":"func hasKerberosCredentialSource(username, password, keytab, ccache string, useTicketCache, useKeytab, useSSPI bool) error {\n\tif useSSPI { return nil }\n\tif useKeytab || keytab != \"\" { return nil }\n\tif useTicketCache || ccache != \"\" { return nil }\n\tif strings.TrimSpace(username) != \"\" && password != \"\" { return nil }\n\treturn errors.New(\"no kerberos credential: need keytab, ccache (kinit), or principal+password\")\n}\n// also verify ccache exists: os.Stat(ccache)","typeGuard":null,"tryCatchPattern":"if err := driver.Connect(cfg); err != nil {\n\tif strings.Contains(err.Error(), \"principal and password\") {\n\t\t// surface actionable guidance: run kinit or configure keytab\n\t\treturn fmt.Errorf(\"kerberos credentials missing: run kinit or set keytab path: %w\", err)\n\t}\n\treturn err\n}","preventionTips":["Run kinit (or a keytab-based kinit -kt) in the service's startup script before connecting.","Set KRB5_CLIENT_KTNAME for keytab auth in Kubernetes/systemd units.","Verify ~/krb5cc or KRB5CCNAME target exists and is fresh (tokens expire).","Document required Kerberos env for the service account in deployment docs."],"tags":["kerberos","config","credentials","keytab"],"backgroundTag":"missing-kerberos-credentials","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}