t8y2/dbx · error

invalid useKeyTab in Cassandra JAAS config: %w

Error message

invalid useKeyTab in Cassandra JAAS config: %w

What it means

The JAAS config's `useKeyTab` option could not be parsed as a Go boolean via strconv.ParseBool. JAAS options are free-form strings, so values like `yes`/`on`/`1 ` (with quotes or whitespace artifacts) fail parsing. The library aborts rather than silently ignoring a malformed credential flag.

Source

Thrown at agents/drivers/cassandra-go/kerberos.go:487

	}
	options := map[string]string{}
	for _, match := range jaasOptionPattern.FindAllSubmatch(module[1], -1) {
		value := firstNonEmpty(string(match[2]), string(match[3]), string(match[4]))
		options[strings.ToLower(string(match[1]))] = value
	}
	if config.principal == "" {
		config.principal = options["principal"]
	}
	if config.keytabPath == "" {
		config.keytabPath = options["keytab"]
	}
	if config.ccachePath == "" {
		config.ccachePath = options["ticketcache"]
	}
	if value, ok := options["usekeytab"]; ok {
		config.useKeytab, err = strconv.ParseBool(value)
		if err != nil {
			return fmt.Errorf("invalid useKeyTab in Cassandra JAAS config: %w", err)
		}
		config.useKeytabSet = true
	}
	if value, ok := options["useticketcache"]; ok {
		config.useTicketCache, err = strconv.ParseBool(value)
		if err != nil {
			return fmt.Errorf("invalid useTicketCache in Cassandra JAAS config: %w", err)
		}
		config.useTicketCacheSet = true
	}
	return nil
}

func javaSystemProperty(name string) string {
	pattern := regexp.MustCompile(`(?:^|\s)-D` + regexp.QuoteMeta(name) + `=(?:"([^"]*)"|'([^']*)'|(\S+))`)
	for _, environmentName := range []string{"JAVA_TOOL_OPTIONS", "_JAVA_OPTIONS", "JDK_JAVA_OPTIONS"} {
		match := pattern.FindStringSubmatch(os.Getenv(environmentName))
		if len(match) == 4 {

View on GitHub (pinned to c0390bff16)

Solutions

1. Set useKeyTab to a boolean strconv accepts: true, false, 1, 0, T, F, TRUE, FALSE (case variants).
2. Remove stray quotes, trailing semicolons, or whitespace around the value in the JAAS file.
3. Remove the useKeyTab option entirely and rely on the default, or control keytab use via the library's own config options instead.
4. Validate the JAAS file with a quick `strconv.ParseBool` check before deployment.

Example fix

// before (jaas.conf)
CassandraJavaClient {
    com.sun.security.auth.module.Krb5LoginModule required useKeyTab=yes;
};
// after
CassandraJavaClient {
    com.sun.security.auth.module.Krb5LoginModule required useKeyTab=true;
};

func validBoolOption(v string) bool {
	_, err := strconv.ParseBool(strings.TrimSpace(strings.Trim(v, "\"'")))
	return err == nil
}

if err := client.Finalize(); err != nil {
	var pe *strconv.NumError
	if strings.Contains(err.Error(), "invalid useKeyTab") {
		log.Fatalf("fix useKeyTab in %s: must be true/false/1/0", jaasPath)
	}
	return err
}

When it happens

Trigger: applyJAASConfig finds a `useKeyTab=<value>` option in the Krb5LoginModule entry whose value is not one of 1, t, T, TRUE, true, True, 0, f, F, FALSE, false, False.

Common situations: Java-style values such as `yes` or `no`; values with surrounding quotes, trailing semicolons, or whitespace captured by the option parser; typos like `ture`; mixing shell-style `true ` into the JAAS file.

Related errors

• invalid useTicketCache in Cassandra JAAS config: %w
• invalid usekrb5 option: %w
• invalid disablepafxfast option: %w
• invalid usekeytab option: %w
• invalid useticketcache option: %w

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/f497dad370c202f0. Report an issue: GitHub.