t8y2/dbx · error

Cassandra JAAS config %s does not contain CassandraJavaClien

Error message

Cassandra JAAS config %s does not contain CassandraJavaClient

What it means

Returned by applyJAASConfig when the JAAS file was read successfully but contains no CassandraJavaClient login block (the regex jaasBlockPattern found no matching entry). The Kerberos authenticator reads its principal/keytab settings from that named block, so a JAAS file with other entries only (or a different block name) is rejected.

Source

Thrown at agents/drivers/cassandra-go/kerberos.go:464

	if config.configPath == "" {
		config.configPath = javaSystemProperty("java.security.krb5.conf")
	}
}

func (config *kerberosConfig) applyKerberosConfigEnvironment() {
	if config.configPath == "" {
		config.configPath = os.Getenv("KRB5_CONFIG")
	}
}

func (config *kerberosConfig) applyJAASConfig(path string) error {
	contents, err := os.ReadFile(path)
	if err != nil {
		return fmt.Errorf("read Cassandra JAAS config %s: %w", path, err)
	}
	block := jaasBlockPattern.FindSubmatch(contents)
	if len(block) != 2 {
		return fmt.Errorf("Cassandra JAAS config %s does not contain CassandraJavaClient", path)
	}
	module := jaasModulePattern.FindSubmatch(block[1])
	if len(module) != 2 {
		return fmt.Errorf("CassandraJavaClient in %s does not configure Krb5LoginModule", path)
	}
	options := map[string]string{}
	for _, match := range jaasOptionPattern.FindAllSubmatch(module[1], -1) {
		value := firstNonEmpty(string(match[2]), string(match[3]), string(match[4]))
		options[strings.ToLower(string(match[1]))] = value
	}
	if config.principal == "" {
		config.principal = options["principal"]
	}
	if config.keytabPath == "" {
		config.keytabPath = options["keytab"]
	}
	if config.ccachePath == "" {
		config.ccachePath = options["ticketcache"]

View on GitHub (pinned to c0390bff16)

Solutions

1. Add a CassandraJavaClient { ... } block to the JAAS config with com.sun.security.auth.module.Krb5LoginModule and the correct principal/keytab
2. Rename any existing block that uses a different client name to CassandraJavaClient
3. Check for typos in the block name and file encoding

When it happens

Trigger: Thrown at agents/drivers/cassandra-go/kerberos.go:464 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/356d0e3335aa6a8c. Report an issue: GitHub.