t8y2/dbx · error

decode Kerberos SASL security-layer challenge: %w

Error message

decode Kerberos SASL security-layer challenge: %w

What it means

Returned by securityLayerResponse when the GSSAPI WrapToken sent by Cassandra as the SASL security-layer challenge cannot be unmarshalled. The bytes are malformed or not a WrapToken (e.g. wrong token ID, truncated frame, or a server speaking a different encoding); the wrapped error from Unmarshal carries the ASN.1 detail.

Source

Thrown at agents/drivers/cassandra-go/kerberos.go:383

	binary.BigEndian.PutUint16(payload, kerberosAPRequestTokenID)
	encodedRequest, err := request.Marshal()
	if err != nil {
		return nil, err
	}
	payload = append(payload, encodedRequest...)
	encodedOID, err := asn1.Marshal(gssapi.OIDKRB5.OID())
	if err != nil {
		return nil, err
	}
	header := append([]byte{kerberosGSSAPITag}, asn1tools.MarshalLengthBytes(len(encodedOID)+len(payload))...)
	header = append(header, encodedOID...)
	return append(header, payload...), nil
}

func (authenticator *kerberosAuthenticator) securityLayerResponse(challenge []byte) ([]byte, error) {
	var request gssapi.WrapToken
	if err := request.Unmarshal(challenge, true); err != nil {
		return nil, fmt.Errorf("decode Kerberos SASL security-layer challenge: %w", err)
	}
	valid, err := request.Verify(authenticator.sessionKey, keyusage.GSSAPI_ACCEPTOR_SEAL)
	if err != nil {
		return nil, fmt.Errorf("verify Kerberos SASL security-layer challenge: %w", err)
	}
	if !valid {
		return nil, fmt.Errorf("invalid Kerberos SASL security-layer challenge")
	}
	if len(request.Payload) < 4 || request.Payload[0]&kerberosSecurityNone == 0 {
		return nil, fmt.Errorf("Cassandra Kerberos server does not allow SASL QOP auth")
	}
	payload := []byte{kerberosSecurityNone, 0, 0, 0}
	payload = append(payload, authenticator.authorizationID...)
	response, err := gssapi.NewInitiatorWrapToken(payload, authenticator.sessionKey)
	if err != nil {
		return nil, err
	}
	return response.Marshal()

View on GitHub (pinned to c0390bff16)

Solutions

1. Check for protocol-version or encoding mismatches between the Cassandra server and the gssapi library used by the agent
2. Capture the challenge bytes / enable driver logging to confirm whether the server sent a valid WrapToken
3. Verify the Kerberos QOP configuration on the server (a non-wrap QOP may send a different token shape)

When it happens

Trigger: Thrown at agents/drivers/cassandra-go/kerberos.go:383 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/b37d6768f307f586. Report an issue: GitHub.