t8y2/dbx · error

invalid disablepafxfast option: %w

Error message

invalid disablepafxfast option: %w

What it means

The 'disablepafxfast' (or 'kerberosdisablepafxfast') URL parameter controls Kerberos PAFX fast negotiation and must parse as a boolean via strconv.ParseBool. Invalid values produce this wrapped error.

Source

Thrown at agents/drivers/cassandra-go/config.go:321

			config.kerberos.realm = value
		case "kerberoskeytab", "keytab":
			config.kerberos.keytabPath = value
		case "kerberosccache", "kerberosticketcache", "ccache", "ticketcache":
			config.kerberos.ccachePath = value
		case "kerberospassword":
			config.kerberos.password = value
		case "kerberosservice", "kerberosservicename", "saslprotocol":
			config.kerberos.serviceName = value
		case "kerberosservername", "saslservername":
			config.kerberos.serverName = value
		case "kerberosauthorizationid", "authorizationid":
			config.kerberos.authorizationID = value
		case "kerberosqop", "saslqop":
			config.kerberos.qop = value
		case "kerberosdisablepafxfast", "disablepafxfast":
			disabled, err := strconv.ParseBool(value)
			if err != nil {
				return fmt.Errorf("invalid disablepafxfast option: %w", err)
			}
			config.kerberos.disablePAFXFAST = disabled
		case "kerberosusekeytab", "usekeytab":
			enabled, err := strconv.ParseBool(value)
			if err != nil {
				return fmt.Errorf("invalid usekeytab option: %w", err)
			}
			config.kerberos.useKeytab = enabled
			config.kerberos.useKeytabSet = true
		case "kerberosuseticketcache", "useticketcache":
			enabled, err := strconv.ParseBool(value)
			if err != nil {
				return fmt.Errorf("invalid useticketcache option: %w", err)
			}
			config.kerberos.useTicketCache = enabled
			config.kerberos.useTicketCacheSet = true
		case "compliancemode":
			// JDBC compliance modes only alter java.sql behavior. The native DBX

View on GitHub (pinned to c0390bff16)

Solutions

1. Set the flag to true or false (strconv.ParseBool-accepted literals)
2. Remove the parameter to keep the default PAFX behavior
3. Verify templated values render a valid boolean before building the DSN

Example fix

// before
cassandra://127.0.0.1/myks?disablepafxfast=off
// after
cassandra://127.0.0.1/myks?disablepafxfast=true

if v := q.Get("disablepafxfast"); v != "" {
	if _, err := strconv.ParseBool(v); err != nil {
		return errors.New("disablepafxfast must be a boolean")
	}
}

if err := parseCassandraConfig(dsn); err != nil {
	if strings.Contains(err.Error(), "disablepafxfast option") {
		return parseCassandraConfig(fixBoolParam(dsn, "disablepafxfast"))
	}
	return err
}

When it happens

Trigger: DSN contains disablepafxfast=<value> or kerberosdisablepafxfast=<value> with a non-boolean string, e.g. disablepafxfast=off.

Common situations: Kerberos hardening guides using 'on'/'off' notation; misconfigured IaC templates emitting empty values; typos adding stray characters to the flag.

Related errors

• invalid usekrb5 option: %w
• invalid usekeytab option: %w
• invalid useticketcache option: %w
• invalid debug option: %w
• invalid disableinitialhostlookup option: %w

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/a8d41da7199f5ca8. Report an issue: GitHub.