t8y2/dbx · error

invalid Kerberos file path: %w

Error message

invalid Kerberos file path: %w

What it means

normalizeKerberosFileReference strips an optional FILE: prefix and validates the keytab (or other file) reference with normalizeLocalFilePath; validation failed. The keytab path handed to selectKeytabCredential is malformed or unusable as a local file path.

Source

Thrown at agents/drivers/cassandra-go/kerberos.go:543

	if err != nil {
		return "", fmt.Errorf("invalid Kerberos credential cache path: %w", err)
	}
	return path, nil
}

func isWindowsDrivePath(value string) bool {
	return len(value) >= 3 && ((value[0] >= 'A' && value[0] <= 'Z') || (value[0] >= 'a' && value[0] <= 'z')) &&
		value[1] == ':' && (value[2] == '\\' || value[2] == '/')
}

func normalizeKerberosFileReference(raw string) (string, error) {
	value := strings.TrimSpace(raw)
	if strings.HasPrefix(strings.ToUpper(value), "FILE:") {
		value = value[5:]
	}
	path, err := normalizeLocalFilePath(value)
	if err != nil {
		return "", fmt.Errorf("invalid Kerberos file path: %w", err)
	}
	return path, nil
}

func splitKerberosPrincipal(principal, configuredRealm, defaultRealm string) (string, string, error) {
	value := strings.TrimSpace(principal)
	realm := strings.TrimSpace(configuredRealm)
	if separator := strings.LastIndexByte(value, '@'); separator >= 0 {
		realm = value[separator+1:]
		value = value[:separator]
	}
	if value == "" {
		return "", "", fmt.Errorf("Kerberos principal is empty")
	}
	if realm == "" {
		realm = strings.TrimSpace(defaultRealm)
	}
	if realm == "" {

View on GitHub (pinned to c0390bff16)

Solutions

1. Provide an absolute expanded path, e.g. /etc/security/keytabs/cassandra.keytab.
2. If using a FILE: prefix, ensure a real path follows it.
3. Check the wrapped normalizeLocalFilePath error for the exact violation and fix the path.
4. Verify the keytab exists and is readable at that path (`klist -kt <path>`).

Example fix

// before
keyTab="FILE:"
// after
keyTab="FILE:/etc/security/keytabs/cassandra.keytab"

func validateKeytabPath(raw string) error {
	p := strings.TrimSpace(raw)
	if strings.HasPrefix(strings.ToUpper(p), "FILE:") { p = p[5:] }
	if !filepath.IsAbs(p) { return fmt.Errorf("keytab path must be absolute: %q", p) }
	if _, err := os.Stat(p); err != nil { return fmt.Errorf("keytab missing: %w", err) }
	return nil
}

if err := client.Finalize(); err != nil {
	if strings.Contains(err.Error(), "invalid Kerberos file path") {
		log.Fatalf("check keyTab path in config/JAAS; must be a valid absolute path")
	}
	return err
}

When it happens

Trigger: selectKeytabCredential resolves the keytab path from config/JAAS (`keyTab=` option) and normalizeLocalFilePath rejects it — empty after FILE: strip, tilde unexpanded, relative path, or otherwise invalid per local-path rules.

Common situations: JAAS keyTab values using `~/` expecting expansion; `FILE:` with a missing path; Java-style file URLs; paths that only make sense on the JVM host, not where this Go driver runs.

Related errors

• remote file URI hosts are not supported: %s
• Kerberos ticket cache path is empty
• invalid Kerberos credential cache path: %w
• Kerberos requires SSPI, credential cache, keytab, or princip
• invalid usekrb5 option: %w

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/3b9618d903e5ccb7. Report an issue: GitHub.