t8y2/dbx · error

invalid Kerberos config path: %w

Error message

invalid Kerberos config path: %w

What it means

kerberosConfig.finalize throws this when normalizeLocalFilePath fails on the Kerberos krb5.conf path (after environment/system-property resolution and taking the first entry of a path list). The driver needs a local krb5.conf to load realms and KDC settings via krb5config.Load.

Source

Thrown at agents/drivers/cassandra-go/kerberos.go:107

func (config *kerberosConfig) finalize(username, password string) error {
	config.applyJavaSystemProperties()
	if config.jaasConfigPath != "" {
		path, err := normalizeLocalFilePath(config.jaasConfigPath)
		if err != nil {
			return fmt.Errorf("invalid Cassandra JAAS config path: %w", err)
		}
		config.jaasConfigPath = path
		if err := config.applyJAASConfig(path); err != nil {
			return err
		}
	}
	config.applyKerberosConfigEnvironment()
	if config.configPath == "" {
		config.configPath = defaultKerberosConfigPath()
	}
	path, err := normalizeLocalFilePath(firstPathListEntry(config.configPath))
	if err != nil {
		return fmt.Errorf("invalid Kerberos config path: %w", err)
	}
	config.configPath = path
	if err := requireRegularFile("Kerberos config", config.configPath); err != nil {
		return err
	}
	krbConfig, err := krb5config.Load(config.configPath)
	if err != nil {
		return fmt.Errorf("load Kerberos config %s: %w", config.configPath, err)
	}
	if config.serviceName == "" {
		config.serviceName = "cassandra"
	}
	if !kerberosQOPIncludesAuth(config.qop) {
		return fmt.Errorf("Cassandra Kerberos currently supports SASL QOP auth only, got %s", config.qop)
	}
	config.qop = "auth"
	if config.principal == "" {
		config.principal = strings.TrimSpace(username)

View on GitHub (pinned to c0390bff16)

Solutions

1. Set the Kerberos config path to a plain local filesystem path to an existing krb5.conf, e.g. /etc/krb5.conf.
2. Check KRB5_CONFIG and java.security.krb5.conf environment/system properties for malformed first entries and fix or unset them.
3. Ensure the default krb5.conf exists at the expected system location or explicitly configure the path.

Example fix

// before
KRB5_CONFIG="profile:/etc/krb5.conf"

// after
KRB5_CONFIG="/etc/krb5.conf"

func validateKrb5Path(p string) error {
    first := strings.Split(p, string(os.PathListSeparator))[0]
    if strings.Contains(first, "://") {
        return fmt.Errorf("Kerberos config must be a local filesystem path, got %q", first)
    }
    if _, err := os.Stat(first); err != nil {
        return fmt.Errorf("krb5.conf not found at %q: %w", first, err)
    }
    return nil
}

func isPlainLocalPath(p string) bool {
    return p != "" && !strings.Contains(p, "://") && !strings.Contains(p, " ")
}

if err := cfg.Finalize(user, pass); err != nil {
    if strings.Contains(err.Error(), "invalid Kerberos config path") {
        return fmt.Errorf("check KRB5_CONFIG / configPath resolves to a local krb5.conf: %w", err)
    }
    return err
}

When it happens

Trigger: finalize resolving configPath (from settings, KRB5_CONFIG env, or java.security.krb5.conf system property, defaulting to defaultKerberosConfigPath()) to a value that is not a valid local file path.

Common situations: KRB5_CONFIG containing a colon-separated list where the first entry is malformed, pointing at a URL/URI-style location, or relying on a default path in a minimal container where /etc/krb5.conf cannot be normalized.

Related errors

• invalid Cassandra JAAS config path: %w
• load Kerberos config %s: %w
• %s path is empty
• Kerberos requires krb5.conf or Windows SSPI
• ZooKeeper Kerberos SASL requires Hive Kerberos credentials

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/8b9b8eebe213a4b9. Report an issue: GitHub.