t8y2/dbx · error

custom Java Kerberos server-name-resolver is not supported;

Error message

custom Java Kerberos server-name-resolver is not supported; use dbx.cassandra.kerberos.server-name

What it means

The Java driver allows pluggable Kerberos NameRules via `advanced.auth-provider.kerberos.server-name-resolver`. applyHOCONAuthentication (config_file.go:217) rejects any non-empty value for this key because the Go driver has no equivalent; Kerberos service/server naming must instead be configured with the library's native `dbx.cassandra.kerberos.server-name` option.

Source

Thrown at agents/drivers/cassandra-go/config_file.go:217

		if value, ok, err := hoconString(parsed, path); err != nil {
			return err
		} else if ok {
			config.kerberos.serviceName = value
		}
	}
	if value, ok, err := hoconStringMap(parsed, prefix+"sasl-properties"); err != nil {
		return err
	} else if ok {
		for key, property := range value {
			if strings.EqualFold(key, "javax.security.sasl.qop") {
				config.kerberos.qop = property
			}
		}
	}
	if value, ok, err := hoconString(parsed, prefix+"server-name-resolver"); err != nil {
		return err
	} else if ok && value != "" {
		return fmt.Errorf("custom Java Kerberos server-name-resolver is not supported; use dbx.cassandra.kerberos.server-name")
	}
	loginPrefix := prefix + "login-configuration."
	if value, ok, err := hoconString(parsed, loginPrefix+"principal"); err != nil {
		return err
	} else if ok {
		config.kerberos.principal = value
	}
	if value, ok, err := firstHOCONString(parsed, loginPrefix+"keyTab", loginPrefix+"keytab"); err != nil {
		return err
	} else if ok {
		config.kerberos.keytabPath = value
	}
	if value, ok, err := firstHOCONString(parsed, loginPrefix+"ticketCache", loginPrefix+"ticket-cache"); err != nil {
		return err
	} else if ok {
		config.kerberos.ccachePath = value
	}
	if value, ok, err := firstHOCONBool(parsed, loginPrefix+"useKeyTab", loginPrefix+"use-keytab"); err != nil {

View on GitHub (pinned to c0390bff16)

Solutions

1. Remove the `kerberos.server-name-resolver` key from the HOCON file.
2. Set the native option `dbx.cassandra.kerberos.server-name` to the Kerberos service principal name portion (e.g. 'cassandra' or host-specific name) the Java resolver used to produce.
3. If DNS translation was involved, resolve the name yourself and hard-code the correct server-name in the native config.
4. Verify the resulting principal with kinit/klist or a test connection to the cluster.

Example fix

// before (application.conf)
datastax-java-driver {
  advanced.auth-provider.kerberos.server-name-resolver = com.datastax.driver.core.kerberos.DnsNameResolver
}
// after (remove key, set native option)
# HOCON: key removed
dbx.cassandra.kerberos.server-name = cassandra

func validateNoKerberosNameResolver(cfg *hocon.Config) error {
    const key = "datastax-java-driver.advanced.auth-provider.kerberos.server-name-resolver"
    if cfg.Get(key) == nil {
        return nil
    }
    if v := strings.TrimSpace(cfg.GetString(key)); v != "" {
        return fmt.Errorf("%s is unsupported; use dbx.cassandra.kerberos.server-name", key)
    }
    return nil
}

if err := applyCassandraConfigFile(cfgPath); err != nil {
    if strings.Contains(err.Error(), "server-name-resolver is not supported") {
        log.Fatalf("remove kerberos.server-name-resolver and set dbx.cassandra.kerberos.server-name instead")
    }
    return err
}

When it happens

Trigger: A HOCON file contains `datastax-java-driver.advanced.auth-provider.kerberos.server-name-resolver` set to a resolver class or non-empty value (e.g. `DnsNameResolver`) while Kerberos auth is configured through the Java-driver section.

Common situations: Migrating a DSE Java driver 1.x config that relied on a custom server-name-resolver for cross-realm or DNS-based principal mapping; environments where the server name differs from the host name and the Java resolver handled the translation.

Related errors

• unsupported Cassandra auth provider class: %s
• unsupported Cassandra SSL engine factory class: %s
• custom Cassandra sslenginefactory is not supported by the na
• invalid usekrb5 option: %w
• invalid disablepafxfast option: %w

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/a876d00fefa698a7. Report an issue: GitHub.