t8y2/dbx · error

create Kerberos client from credential cache: %w

Error message

create Kerberos client from credential cache: %w

What it means

After a ccache file is successfully loaded, krb5client.NewFromCCache builds a client from it. Failure here means the cache contents are unusable for authentication: the principal's realm is unknown, credentials are expired/invalid, or the cache does not match the configured krb5 realms.

Source

Thrown at agents/drivers/cassandra-go/kerberos.go:295

		ticket:          ticket,
		sessionKey:      sessionKey,
		authorizationID: config.authorizationID,
	}
	client.Destroy()
	return authenticator, nil
}

func newKerberosClient(config kerberosConfig, krbConfig *krb5config.Config) (*krb5client.Client, error) {
	settings := []func(*krb5client.Settings){krb5client.DisablePAFXFAST(config.disablePAFXFAST)}
	switch config.credentialMode {
	case kerberosCredentialCCache:
		cache, err := credentials.LoadCCache(config.ccachePath)
		if err != nil {
			return nil, fmt.Errorf("load Kerberos credential cache %s: %w", config.ccachePath, err)
		}
		client, err := krb5client.NewFromCCache(cache, krbConfig, settings...)
		if err != nil {
			return nil, fmt.Errorf("create Kerberos client from credential cache: %w", err)
		}
		return client, nil
	case kerberosCredentialKeytab:
		loadedKeytab, err := keytab.Load(config.keytabPath)
		if err != nil {
			return nil, fmt.Errorf("load Kerberos keytab %s: %w", config.keytabPath, err)
		}
		return krb5client.NewWithKeytab(
			config.credentialUser,
			config.credentialRealm,
			loadedKeytab,
			krbConfig,
			settings...,
		), nil
	case kerberosCredentialPassword:
		return krb5client.NewWithPassword(
			config.credentialUser,
			config.credentialRealm,

View on GitHub (pinned to c0390bff16)

Solutions

1. Re-run `kinit` to refresh credentials and try again.
2. Add/fix the principal's realm in krb5.conf (realms and domain_realm sections).
3. Verify the cached principal matches the expected user/realm (`klist -c <path>`).

Example fix

// before: krb5.conf lacks EXAMPLE.COM realm
// after
// [realms]
//   EXAMPLE.COM = { kdc = kdc.example.com }

// confirm realm of cached principal is in krb5.conf:
cache, err := credentials.LoadCCache(path)
if err == nil {
	realm := cache.Credentials.Domain()
	if !krbConfHasRealm(realm) {
		return fmt.Errorf("ccache principal realm %q missing from krb5.conf", realm)
	}
}

When it happens

Trigger: LoadCCache succeeded but krb5client.NewFromCCache returns an error — e.g. ccache contains a principal whose realm has no entry in krb5.conf, expired tickets, or malformed/incompatible cache entries.

Common situations: krb5.conf missing the realm of the cached principal; ticket expired between kinit and connect; ccache from a different realm than config.realm.

Related errors

• load Kerberos credential cache %s: %w
• Kerberos credentials are not configured
• Kerberos requires SSPI, credential cache, keytab, or princip
• Kerberos authentication requires a credential cache, keytab,
• Kerberos keytab authentication requires a keytab path

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/3730a493f2878016. Report an issue: GitHub.