t8y2/dbx · error

Cassandra Kerberos server does not allow SASL QOP auth

Error message

Cassandra Kerberos server does not allow SASL QOP auth

What it means

Returned by securityLayerResponse when the decoded security-layer challenge advertises a SASL QOP list that does not include 'auth'. Cassandra's Kerberos negotiation requires QOP auth (integrity/protection-only configurations are rejected), so a server configured with e.g. only 'auth-int' or 'auth-conf' fails this guard.

Source

Thrown at agents/drivers/cassandra-go/kerberos.go:393

	header := append([]byte{kerberosGSSAPITag}, asn1tools.MarshalLengthBytes(len(encodedOID)+len(payload))...)
	header = append(header, encodedOID...)
	return append(header, payload...), nil
}

func (authenticator *kerberosAuthenticator) securityLayerResponse(challenge []byte) ([]byte, error) {
	var request gssapi.WrapToken
	if err := request.Unmarshal(challenge, true); err != nil {
		return nil, fmt.Errorf("decode Kerberos SASL security-layer challenge: %w", err)
	}
	valid, err := request.Verify(authenticator.sessionKey, keyusage.GSSAPI_ACCEPTOR_SEAL)
	if err != nil {
		return nil, fmt.Errorf("verify Kerberos SASL security-layer challenge: %w", err)
	}
	if !valid {
		return nil, fmt.Errorf("invalid Kerberos SASL security-layer challenge")
	}
	if len(request.Payload) < 4 || request.Payload[0]&kerberosSecurityNone == 0 {
		return nil, fmt.Errorf("Cassandra Kerberos server does not allow SASL QOP auth")
	}
	payload := []byte{kerberosSecurityNone, 0, 0, 0}
	payload = append(payload, authenticator.authorizationID...)
	response, err := gssapi.NewInitiatorWrapToken(payload, authenticator.sessionKey)
	if err != nil {
		return nil, err
	}
	return response.Marshal()
}

func kerberosAuthenticatorChecksum() []byte {
	checksum := make([]byte, 24)
	binary.LittleEndian.PutUint32(checksum[:4], 16)
	flags := uint32(gssapi.ContextFlagInteg | gssapi.ContextFlagConf)
	binary.LittleEndian.PutUint32(checksum[20:24], flags)
	return checksum
}

View on GitHub (pinned to c0390bff16)

Solutions

1. Configure the Cassandra server's SASL QOP to include 'auth' (e.g. qop=auth in the server's jaas/krb5 SASL settings)
2. Restart the Cassandra node after changing QOP so new negotiations advertise the updated list

When it happens

Trigger: Thrown at agents/drivers/cassandra-go/kerberos.go:393 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/c764de1dc92edddd. Report an issue: GitHub.