t8y2/dbx · error

get Kerberos service ticket for %s: %w

Error message

get Kerberos service ticket for %s: %w

What it means

After a successful login, the authenticator requests a service ticket for "<serviceName>/<serverName>" (default service "cassandra") from the KDC via client.GetServiceTicket. Failure means the KDC refused or could not issue a ticket for that service principal; the error is wrapped with the exact service principal used.

Source

Thrown at agents/drivers/cassandra-go/kerberos.go:270

) (gocql.Authenticator, error) {
	client, err := newKerberosClient(config, krbConfig)
	if err != nil {
		return nil, err
	}
	if err := client.Login(); err != nil {
		client.Destroy()
		return nil, fmt.Errorf("Kerberos login failed: %w", err)
	}
	serverName, err := kerberosServerName(config, host)
	if err != nil {
		client.Destroy()
		return nil, err
	}
	servicePrincipal := config.serviceName + "/" + serverName
	ticket, sessionKey, err := client.GetServiceTicket(servicePrincipal)
	if err != nil {
		client.Destroy()
		return nil, fmt.Errorf("get Kerberos service ticket for %s: %w", servicePrincipal, err)
	}
	clientName := client.Credentials.CName()
	clientName.NameString = append([]string(nil), clientName.NameString...)
	authenticator := &kerberosAuthenticator{
		domain:          strings.Clone(client.Credentials.Domain()),
		clientName:      clientName,
		ticket:          ticket,
		sessionKey:      sessionKey,
		authorizationID: config.authorizationID,
	}
	client.Destroy()
	return authenticator, nil
}

func newKerberosClient(config kerberosConfig, krbConfig *krb5config.Config) (*krb5client.Client, error) {
	settings := []func(*krb5client.Settings){krb5client.DisablePAFXFAST(config.disablePAFXFAST)}
	switch config.credentialMode {
	case kerberosCredentialCCache:

View on GitHub (pinned to c0390bff16)

Solutions

1. Check the principal in the error exists in the KDC: `kadmin: list_princs` and add it (`ank cassandra/<host>@REALM`) if missing.
2. Match config.serviceName to the service part of the server's actual principal (cassandra vs dse, etc.).
3. Fix hostname resolution so serverName matches the host part registered in the KDC (forward/reverse DNS or /etc/hosts).
4. For cross-realm access, configure trust/capaths in krb5.conf.

Example fix

// before
serviceName: "cassandra" // server keytab holds dse/node1@REALM

// after
serviceName: "dse"

principal := cfg.serviceName + "/" + host.Name
// verify before connecting:
// kadmin: list_princs | grep cassandra/<host>@REALM
// or test: kvno cassandra/<host>@REALM

auth, err := provider(host)
if err != nil {
	var target string
	if strings.Contains(err.Error(), "get Kerberos service ticket for") {
		fmt.Sscanf(err.Error(), "get Kerberos service ticket for %s", &target) // log offending principal
	}
	return err
}

When it happens

Trigger: GetServiceTicket fails for servicePrincipal = serviceName + "/" + serverName — the service principal (e.g. cassandra/node1.domain@REALM) does not exist in the KDC database, serverName resolution picked the wrong hostname, or cross-realm trust issues.

Common situations: Cassandra node registered in KDC under a different principal than the hostname the client resolved (missing reverse DNS/hostname mismatch); serviceName configured differently from the server's keytab (e.g. server uses 'dse' not 'cassandra'); principal not created in the realm.

Related errors

• ZooKeeper SASL round %d: %w
• Kerberos login failed: %w
• IoTDB is not reachable at {host}:{port}
• token contains trailing data
• Kerberos requires krb5.conf or Windows SSPI

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/623b8613b5500ce5. Report an issue: GitHub.