t8y2/dbx · error

Cassandra Kerberos currently supports SASL QOP auth only, go

Error message

Cassandra Kerberos currently supports SASL QOP auth only, got %s

What it means

finalize throws this when the configured SASL QOP value does not include "auth". The driver implements only QOP level auth (authentication without integrity/privacy); values like auth-int or auth-conf are rejected because the Go implementation does not support SASL integrity or confidentiality layers.

Source

Thrown at agents/drivers/cassandra-go/kerberos.go:121

		config.configPath = defaultKerberosConfigPath()
	}
	path, err := normalizeLocalFilePath(firstPathListEntry(config.configPath))
	if err != nil {
		return fmt.Errorf("invalid Kerberos config path: %w", err)
	}
	config.configPath = path
	if err := requireRegularFile("Kerberos config", config.configPath); err != nil {
		return err
	}
	krbConfig, err := krb5config.Load(config.configPath)
	if err != nil {
		return fmt.Errorf("load Kerberos config %s: %w", config.configPath, err)
	}
	if config.serviceName == "" {
		config.serviceName = "cassandra"
	}
	if !kerberosQOPIncludesAuth(config.qop) {
		return fmt.Errorf("Cassandra Kerberos currently supports SASL QOP auth only, got %s", config.qop)
	}
	config.qop = "auth"
	if config.principal == "" {
		config.principal = strings.TrimSpace(username)
	}
	if config.password == "" {
		config.password = password
	}
	if config.useTicketCache {
		return config.selectCCacheCredential()
	}
	if config.useKeytab {
		return config.selectKeytabCredential(krbConfig)
	}
	if config.ccachePath != "" && !config.useTicketCacheSet {
		return config.selectCCacheCredential()
	}
	if config.keytabPath != "" && !config.useKeytabSet {

View on GitHub (pinned to c0390bff16)

Solutions

1. Set qop to "auth" (or remove it entirely — the default is already "auth") and rely on TLS for integrity/privacy instead.
2. If you need auth-conf/auth-int, enable CQL TLS/SSL on the connection and drop the SASL QOP requirement.
3. Remove comma-separated QOP lists and use the single value "auth".

Example fix

// before
config.QOP = "auth-conf"

// after
config.QOP = "auth"

func validateQOP(qop string) error {
    qop = strings.ToLower(strings.TrimSpace(qop))
    if qop != "" && qop != "auth" {
        return fmt.Errorf("only SASL QOP 'auth' is supported, got %q", qop)
    }
    return nil
}

func isAuthOnlyQOP(qop string) bool {
    return strings.ToLower(strings.TrimSpace(qop)) == "auth" || qop == ""
}

if err := cfg.Finalize(user, pass); err != nil {
    if strings.Contains(err.Error(), "SASL QOP auth only") {
        return fmt.Errorf("set qop to 'auth' and use TLS for integrity/privacy: %w", err)
    }
    return err
}

When it happens

Trigger: Creating a Kerberos auth provider (newKerberosAuthProvider -> finalize) with qop set to "auth-int", "auth-conf", "auth,auth-int", or any unrecognized value, causing kerberosQOPIncludesAuth to fail.

Common situations: Porting a Java Cassandra driver config where sasl.qop=auth-conf was used for encrypted traffic, or combining QOP values with commas as the Java driver allows.

Related errors

• ZooKeeper session closed because SASL authentication is requ
• ZooKeeper Kerberos SASL requires Hive Kerberos credentials
• ZooKeeper SASL client is nil
• ZooKeeper session closed because SASL authentication is requ
• ZooKeeper Kerberos SASL requires Hive Kerberos credentials

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/e9994175e067146b. Report an issue: GitHub.