t8y2/dbx · error

invalid Kerberos credential cache path: %w

Error message

invalid Kerberos credential cache path: %w

What it means

After stripping an optional FILE: prefix, normalizeKerberosCachePath validates the remaining path with normalizeLocalFilePath and it failed. This is a wrapped path-validation error — the ccache path is malformed (e.g. not absolute/expanded, contains an invalid user-home reference, or normalizeLocalFilePath rejected it).

Source

Thrown at agents/drivers/cassandra-go/kerberos.go:526

	}
	return ""
}

func normalizeKerberosCachePath(raw string) (string, error) {
	value := strings.TrimSpace(raw)
	if value == "" {
		return "", fmt.Errorf("Kerberos ticket cache path is empty")
	}
	if separator := strings.IndexByte(value, ':'); separator > 0 && !isWindowsDrivePath(value) {
		cacheType := strings.ToUpper(value[:separator])
		if cacheType != "FILE" {
			return "", fmt.Errorf("Kerberos credential cache type %s is not supported; use a FILE cache or keytab", cacheType)
		}
		value = value[separator+1:]
	}
	path, err := normalizeLocalFilePath(value)
	if err != nil {
		return "", fmt.Errorf("invalid Kerberos credential cache path: %w", err)
	}
	return path, nil
}

func isWindowsDrivePath(value string) bool {
	return len(value) >= 3 && ((value[0] >= 'A' && value[0] <= 'Z') || (value[0] >= 'a' && value[0] <= 'z')) &&
		value[1] == ':' && (value[2] == '\\' || value[2] == '/')
}

func normalizeKerberosFileReference(raw string) (string, error) {
	value := strings.TrimSpace(raw)
	if strings.HasPrefix(strings.ToUpper(value), "FILE:") {
		value = value[5:]
	}
	path, err := normalizeLocalFilePath(value)
	if err != nil {
		return "", fmt.Errorf("invalid Kerberos file path: %w", err)
	}

View on GitHub (pinned to c0390bff16)

Solutions

1. Use an absolute, expanded path (no `~`; substitute $HOME or the literal /home/user path).
2. Ensure the FILE: prefix has an actual path after it (FILE:/tmp/krb5cc_1000, not FILE:).
3. Log/inspect the wrapped inner error from normalizeLocalFilePath for the exact rule violated and correct the path accordingly.
4. Point the ticket cache at the file kinit actually created (check with `klist`).

Example fix

// before
ticketcache="~/krb5cc"
// after
ticketcache="/home/cassandra/krb5cc"

func validateCCachePath(raw string) (string, error) {
	p := strings.TrimSpace(raw)
	p = strings.TrimPrefix(strings.ToUpper(p[:min(5, len(p))])+p[min(5, len(p)):], "FILE:")
	p = os.ExpandEnv(p)
	if !filepath.IsAbs(p) { return "", fmt.Errorf("ccache path must be absolute, got %q", p) }
	if _, err := os.Stat(p); err != nil { return "", err }
	return p, nil
}

if err := client.Finalize(); err != nil {
	if strings.Contains(err.Error(), "invalid Kerberos credential cache path") {
		log.Fatalf("fix ticketcache path (absolute, expanded, no bare FILE:)")
	}
	return err
}

When it happens

Trigger: ticketcache value like `~/krb5cc` (tilde unexpanded), a relative path, or a path normalizeLocalFilePath rejects (empty after FILE: strip, or other local-path rule violations) passed via config, JAAS TicketCache option, or KRB5CCNAME.

Common situations: Using `~` in config files expecting shell expansion; `FILE:` with nothing after it; container images where the referenced path is on a filesystem the validator rejects; copied Java configs using file: URLs.

Related errors

• remote file URI hosts are not supported: %s
• Kerberos ticket cache path is empty
• invalid usekrb5 option: %w
• invalid disablepafxfast option: %w
• invalid usekeytab option: %w

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/19e1db28b0aab5af. Report an issue: GitHub.