t8y2/dbx · error

invalid Kerberos SASL security-layer challenge

Error message

invalid Kerberos SASL security-layer challenge

What it means

Returned by securityLayerResponse when the security-layer challenge token decodes and its checksum verifies, but the embedded token ID/tag is not the expected GSSAPI wrap value — i.e. the token is structurally valid but not a valid acceptor-seal challenge. This is a protocol-shape guard against unexpected token types during Kerberos SASL negotiation.

Source

Thrown at agents/drivers/cassandra-go/kerberos.go:390

	if err != nil {
		return nil, err
	}
	header := append([]byte{kerberosGSSAPITag}, asn1tools.MarshalLengthBytes(len(encodedOID)+len(payload))...)
	header = append(header, encodedOID...)
	return append(header, payload...), nil
}

func (authenticator *kerberosAuthenticator) securityLayerResponse(challenge []byte) ([]byte, error) {
	var request gssapi.WrapToken
	if err := request.Unmarshal(challenge, true); err != nil {
		return nil, fmt.Errorf("decode Kerberos SASL security-layer challenge: %w", err)
	}
	valid, err := request.Verify(authenticator.sessionKey, keyusage.GSSAPI_ACCEPTOR_SEAL)
	if err != nil {
		return nil, fmt.Errorf("verify Kerberos SASL security-layer challenge: %w", err)
	}
	if !valid {
		return nil, fmt.Errorf("invalid Kerberos SASL security-layer challenge")
	}
	if len(request.Payload) < 4 || request.Payload[0]&kerberosSecurityNone == 0 {
		return nil, fmt.Errorf("Cassandra Kerberos server does not allow SASL QOP auth")
	}
	payload := []byte{kerberosSecurityNone, 0, 0, 0}
	payload = append(payload, authenticator.authorizationID...)
	response, err := gssapi.NewInitiatorWrapToken(payload, authenticator.sessionKey)
	if err != nil {
		return nil, err
	}
	return response.Marshal()
}

func kerberosAuthenticatorChecksum() []byte {
	checksum := make([]byte, 24)
	binary.LittleEndian.PutUint32(checksum[:4], 16)
	flags := uint32(gssapi.ContextFlagInteg | gssapi.ContextFlagConf)
	binary.LittleEndian.PutUint32(checksum[20:24], flags)

View on GitHub (pinned to c0390bff16)

Solutions

1. Confirm the server implements the expected GSSAPI security-layer semantics for Cassandra Kerberos auth
2. Compare the server's SASL implementation version with what the agent expects
3. Enable Kerberos packet tracing to inspect the token ID actually received

When it happens

Trigger: Thrown at agents/drivers/cassandra-go/kerberos.go:390 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/aabe97fdbd420632. Report an issue: GitHub.