t8y2/dbx · error

invalid Cassandra JAAS config path: %w

Error message

invalid Cassandra JAAS config path: %w

What it means

kerberosConfig.finalize throws this when normalizeLocalFilePath fails on the configured JAAS config path (jaasConfigPath), typically because the path is not a local file path (e.g. a URL, remote reference, or otherwise malformed). The driver requires a JAAS login config file on local disk to extract Krb5LoginModule options.

Source

Thrown at agents/drivers/cassandra-go/kerberos.go:94

var (
	jaasBlockPattern  = regexp.MustCompile(`(?is)\bCassandraJavaClient\s*\{(.*?)\}\s*;`)
	jaasModulePattern = regexp.MustCompile(`(?is)\bcom\.sun\.security\.auth\.module\.Krb5LoginModule\b(.*?);`)
	jaasOptionPattern = regexp.MustCompile(`(?is)([A-Za-z][A-Za-z0-9_-]*)\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s;]+))`)
)

func defaultKerberosConfig() kerberosConfig {
	return kerberosConfig{
		serviceName: "cassandra",
		qop:         "auth",
	}
}

func (config *kerberosConfig) finalize(username, password string) error {
	config.applyJavaSystemProperties()
	if config.jaasConfigPath != "" {
		path, err := normalizeLocalFilePath(config.jaasConfigPath)
		if err != nil {
			return fmt.Errorf("invalid Cassandra JAAS config path: %w", err)
		}
		config.jaasConfigPath = path
		if err := config.applyJAASConfig(path); err != nil {
			return err
		}
	}
	config.applyKerberosConfigEnvironment()
	if config.configPath == "" {
		config.configPath = defaultKerberosConfigPath()
	}
	path, err := normalizeLocalFilePath(firstPathListEntry(config.configPath))
	if err != nil {
		return fmt.Errorf("invalid Kerberos config path: %w", err)
	}
	config.configPath = path
	if err := requireRegularFile("Kerberos config", config.configPath); err != nil {
		return err
	}

View on GitHub (pinned to c0390bff16)

Solutions

1. Set jaasConfigPath to an absolute or relative local filesystem path to an existing JAAS file, e.g. /etc/cassandra/jaas.conf.
2. Remove any URL or classpath scheme from the path.
3. Verify the file exists and is readable at the configured path before constructing the provider.

Example fix

// before
config.JAASConfigPath = "classpath:jaas.conf"

// after
config.JAASConfigPath = "/etc/cassandra/jaas.conf"

func validateJAASPath(p string) error {
    if p == "" {
        return nil
    }
    if strings.Contains(p, "://") || strings.HasPrefix(p, "classpath:") {
        return fmt.Errorf("JAAS config must be a local filesystem path, got %q", p)
    }
    info, err := os.Stat(p)
    if err != nil {
        return fmt.Errorf("JAAS config not found: %w", err)
    }
    if info.IsDir() {
        return fmt.Errorf("JAAS config path is a directory: %s", p)
    }
    return nil
}

func isLocalFilePath(p string) bool {
    return p != "" && !strings.Contains(p, "://") && filepath.IsAbs(p) || filepath.Base(p) == p || strings.HasPrefix(p, "/")
}

if err := provider.Finalize(user, pass); err != nil {
    var perr *fs.PathError
    if errors.As(err, &perr) || strings.Contains(err.Error(), "invalid Cassandra JAAS config path") {
        return fmt.Errorf("check jaasConfigPath points to a local jaas.conf file: %w", err)
    }
    return err
}

When it happens

Trigger: Setting cassandra-auth JAAS config to a non-local path (http://..., classpath:..., or an empty/malformed path) and creating a Kerberos auth provider, which calls finalize.

Common situations: Copying Java driver settings where the JAAS config was referenced via java.security.auth.login.config with a classpath or URL form, or pointing at a file that does not exist locally.

Related errors

• invalid Kerberos config path: %w
• %s path is empty
• Kerberos JAAS config contains no Krb5LoginModule
• ZooKeeper Kerberos SASL requires Hive Kerberos credentials
• Kerberos JAAS config contains no Krb5LoginModule

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/9c995f450c90d1e9. Report an issue: GitHub.