t8y2/dbx · error

Cassandra reported Kerberos success before SASL negotiation

Error message

Cassandra reported Kerberos success before SASL negotiation completed

What it means

Returned by kerberosAuthenticator.Success when Cassandra signals authentication success while the authenticator is still at negotiation step 0 or 1 — i.e. the server accepted before the client sent its AP-REQ/security-layer token. This guards against a truncated or mis-sequenced SASL exchange that would otherwise leave the session without an established security layer.

Source

Thrown at agents/drivers/cassandra-go/kerberos.go:346

			return nil, nil, err
		}
		authenticator.step = 1
		return token, authenticator, nil
	case 1:
		token, err := authenticator.securityLayerResponse(request)
		if err != nil {
			return nil, nil, err
		}
		authenticator.step = 2
		return token, authenticator, nil
	default:
		return nil, nil, fmt.Errorf("unexpected Cassandra Kerberos authentication challenge")
	}
}

func (authenticator *kerberosAuthenticator) Success(_ []byte) error {
	if authenticator.step != 2 {
		return fmt.Errorf("Cassandra reported Kerberos success before SASL negotiation completed")
	}
	return nil
}

func (authenticator *kerberosAuthenticator) initialToken() ([]byte, error) {
	value, err := types.NewAuthenticator(authenticator.domain, authenticator.clientName)
	if err != nil {
		return nil, err
	}
	value.Cksum = types.Checksum{
		CksumType: chksumtype.GSSAPI,
		Checksum:  kerberosAuthenticatorChecksum(),
	}
	request, err := messages.NewAPReq(authenticator.ticket, authenticator.sessionKey, value)
	if err != nil {
		return nil, err
	}
	payload := make([]byte, 2)

View on GitHub (pinned to c0390bff16)

Solutions

1. Verify the Cassandra server's SASL mechanism is Kerberos (GSSAPI) and not a simpler mechanism that finishes early
2. Check for a mismatch between server and client QOP/security-layer expectations
3. Ensure the driver and server agree on the Kerberos protocol version

When it happens

Trigger: Thrown at agents/drivers/cassandra-go/kerberos.go:346 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/3dec9c95c295334c. Report an issue: GitHub.