{"record":{"id":"fdff3c97665205b3","repo":"t8y2/dbx","slug":"read-kerberos-jaas-config-w-fdff3c","errorCode":null,"errorMessage":"read Kerberos JAAS config: %w","messagePattern":"read Kerberos JAAS config: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/hive-go/config.go","lineNumber":964,"sourceCode":"\tif kerberos.KeytabPath != \"\" {\n\t\tkerberos.UseKeytab = true\n\t}\n\tif kerberos.CCachePath != \"\" {\n\t\tkerberos.UseTicketCache = true\n\t}\n\tkerberos.Realm = firstNonEmpty(kerberos.Realm, realmFromPrincipal(kerberos.ClientPrincipal))\n\tif !kerberos.UseTicketCache && !kerberos.UseKeytab && (kerberos.ClientPrincipal == \"\" || kerberos.Password == \"\") {\n\t\treturn errors.New(\"Kerberos requires SSPI, credential cache, keytab, or principal and password\")\n\t}\n\treturn nil\n}\n\nvar jaasOptionPattern = regexp.MustCompile(`(?i)\\b(principal|keytab|ticketcache|usekeytab|useticketcache)\\s*=\\s*(\"(?:\\\\.|[^\"])*\"|'(?:\\\\.|[^'])*'|[^\\s;]+)`)\n\nfunc applyKerberosJAASFile(config *kerberosConfig) error {\n\tcontents, err := os.ReadFile(config.JAASConfigPath)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"read Kerberos JAAS config: %w\", err)\n\t}\n\ttext := string(contents)\n\tmodule := strings.Index(strings.ToLower(text), \"krb5loginmodule\")\n\tif module < 0 {\n\t\treturn errors.New(\"Kerberos JAAS config contains no Krb5LoginModule\")\n\t}\n\tblock := text[module:]\n\tif end := strings.IndexByte(block, ';'); end >= 0 {\n\t\tblock = block[:end]\n\t}\n\tfor _, match := range jaasOptionPattern.FindAllStringSubmatch(block, -1) {\n\t\tkey := strings.ToLower(match[1])\n\t\tvalue := decodeJAASValue(match[2])\n\t\tswitch key {\n\t\tcase \"principal\":\n\t\t\tif config.ClientPrincipal == \"\" {\n\t\t\t\tconfig.ClientPrincipal = value\n\t\t\t}","sourceCodeStart":946,"sourceCodeEnd":982,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/hive-go/config.go#L946-L982","documentation":"This error wraps an os.ReadFile failure when loading the Kerberos JAAS config file specified by the jaasConfigPath setting. The driver reads this file to extract Krb5LoginModule options (principal, keytab, ticketCache) for Kerberos authentication. The wrapped error will be an os-level error (file not found, permission denied), so the JAAS file could not be opened at all.","triggerScenarios":"Setting jaasConfigPath to a nonexistent path, a path the process cannot read (permissions), or a path inside a container/image that lacks the file.","commonSituations":"Mounting the keytab/JAAS file at a different path than configured; running the app as a non-root user without read access to /etc/krb5-related files; Docker/K8s secret not mounted; typo in the configured path.","solutions":["Verify the file exists at the configured path (ls/stat) and fix the jaasConfigPath value","Grant the running user read permission on the JAAS file (chmod/chown or group membership)","In containers, confirm the file is mounted (K8s secret volume) at the exact configured path"],"exampleFix":"// before\ncfg.Kerberos.JAASConfigPath = \"/etc/secrets/jaas.conf\" // not mounted\n// after\ncfg.Kerberos.JAASConfigPath = \"/mnt/kerberos/jaas.conf\" // actual mount point","handlingStrategy":"validation","validationCode":"path := cfg.Kerberos.JAASConfigPath\nif _, err := os.Stat(path); err != nil {\n\treturn fmt.Errorf(\"JAAS config unavailable: %w\", err)\n} else if f, err := os.OpenFile(path, os.O_RDONLY, 0); err != nil {\n\treturn fmt.Errorf(\"JAAS config unreadable: %w\", err)\n} else { f.Close() }","typeGuard":null,"tryCatchPattern":"err := cfg.ApplyKerberosFromJAAS(path)\nif err != nil {\n\tvar perr *fs.PathError\n\tif errors.As(err, &perr) {\n\t\treturn fmt.Errorf(\"fix JAAS path/permissions: %w\", err)\n\t}\n\treturn err\n}","preventionTips":["Verify JAAS file existence and readability at startup, before Kerberos auth","In containers, mount the JAAS/keytab files and use the mount path in config","Run the process as a user with read access to Kerberos config files"],"tags":["kerberos","file-io","jaas","config"],"backgroundTag":"file-not-found","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}