CassandraJavaClient in %s does not configure Krb5LoginModule

Error message

CassandraJavaClient in %s does not configure Krb5LoginModule

What it means

applyJAASConfig parses a JAAS login config file and expects a `CassandraJavaClient { com.sun.security.auth.module.Krb5LoginModule ... };` block. The block was found, but the regex for the Krb5LoginModule entry (jaasModulePattern) matched nothing inside it, meaning the block does not actually configure a Kerberos login module. The library refuses to guess credentials from a JAAS block without a Krb5LoginModule.

Source

Thrown at agents/drivers/cassandra-go/kerberos.go:468

func (config *kerberosConfig) applyKerberosConfigEnvironment() {
	if config.configPath == "" {
		config.configPath = os.Getenv("KRB5_CONFIG")
	}
}

func (config *kerberosConfig) applyJAASConfig(path string) error {
	contents, err := os.ReadFile(path)
	if err != nil {
		return fmt.Errorf("read Cassandra JAAS config %s: %w", path, err)
	}
	block := jaasBlockPattern.FindSubmatch(contents)
	if len(block) != 2 {
		return fmt.Errorf("Cassandra JAAS config %s does not contain CassandraJavaClient", path)
	}
	module := jaasModulePattern.FindSubmatch(block[1])
	if len(module) != 2 {
		return fmt.Errorf("CassandraJavaClient in %s does not configure Krb5LoginModule", path)
	}
	options := map[string]string{}
	for _, match := range jaasOptionPattern.FindAllSubmatch(module[1], -1) {
		value := firstNonEmpty(string(match[2]), string(match[3]), string(match[4]))
		options[strings.ToLower(string(match[1]))] = value
	}
	if config.principal == "" {
		config.principal = options["principal"]
	}
	if config.keytabPath == "" {
		config.keytabPath = options["keytab"]
	}
	if config.ccachePath == "" {
		config.ccachePath = options["ticketcache"]
	}
	if value, ok := options["usekeytab"]; ok {
		config.useKeytab, err = strconv.ParseBool(value)
		if err != nil {

View on GitHub (pinned to c0390bff16)

Solutions

Add a `com.sun.security.auth.module.Krb5LoginModule required ...;` entry inside the CassandraJavaClient block of the JAAS file.
Check the module class name spelling exactly (com.sun.security.auth.module.Krb5LoginModule) and that it ends with a semicolon.
Simplify the block formatting to the standard JAAS layout (no odd comments/nested braces) and retry.
If Kerberos is not needed, remove the JAAS config path (java.security.auth.login.config / jaas config option) instead of pointing at a non-Kerberos file.

Example fix

// before (jaas.conf)
CassandraJavaClient {
    other.Module required;
};
// after
CassandraJavaClient {
    com.sun.security.auth.module.Krb5LoginModule required
        useKeyTab=true
        keyTab="/etc/security/keytabs/cassandra.keytab"
        principal="cassandra/_HOST@EXAMPLE.COM";
};

Defensive patterns

Strategy: validation

Validate before calling

func validateJAAS(path string) error {
	b, err := os.ReadFile(path)
	if err != nil { return err }
	block := regexp.MustCompile(`(?is)CassandraJavaClient\s*\{(.*?)\}`).FindSubmatch(b)
	if block == nil { return fmt.Errorf("no CassandraJavaClient block") }
	if !regexp.MustCompile(`(?i)Krb5LoginModule`).Match(block[1]) {
		return fmt.Errorf("CassandraJavaClient block lacks Krb5LoginModule")
	}
	return nil
}

Type guard

func hasKrb5Module(jaas string) bool {
	return strings.Contains(strings.ToLower(jaas), "krb5loginmodule")
}

Try / catch

if err := client.Finalize(); err != nil {
	if strings.Contains(err.Error(), "does not configure Krb5LoginModule") {
		log.Fatalf("JAAS config %s needs com.sun.security.auth.module.Krb5LoginModule", jaasPath)
	}
	return err
}

Prevention

Keep the JAAS block in the standard layout: CassandraJavaClient { com.sun.security.auth.module.Krb5LoginModule required ...; };
Lint the JAAS file in CI with a regex check for Krb5LoginModule before deploy.
Never copy non-Kerberos JAAS files for Kerberos-enabled clusters.
Test JAAS parsing locally before rollout.

When it happens

Trigger: Calling the client's finalize path with a JAAS config whose CassandraJavaClient block contains no `com.sun.security.auth.module.Krb5LoginModule required ...;` entry — e.g. the block is empty, uses a different/misspelled module class, or only uses another LoginModule.

Common situations: Reusing a JAAS file from a non-Kerberos Cassandra setup; copying a Java example that used a different login module; hand-editing the JAAS file and deleting the module line while keeping the block wrapper; trailing comment or unusual whitespace/formatting inside the block that the parser does not recognize.

Related errors

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/00552f63f99b225a. Report an issue: GitHub.