t8y2/dbx · error

Kerberos authentication is not enabled

Error message

Kerberos authentication is not enabled

What it means

newKerberosAuthProvider returns this immediately when config.enabled is false, i.e. Kerberos authentication was not turned on for this cluster configuration, yet the code path tried to construct a Kerberos auth provider. It is an internal consistency guard: the auth provider factory only works when Kerberos was explicitly enabled.

Source

Thrown at agents/drivers/cassandra-go/kerberos.go:232

	config.credentialUser, config.credentialRealm, err = splitKerberosPrincipal(
		config.principal,
		config.realm,
		krbConfig.LibDefaults.DefaultRealm,
	)
	if err != nil {
		return err
	}
	config.credentialMode = kerberosCredentialKeytab
	return nil
}

func newKerberosAuthProvider(
	config kerberosConfig,
	username string,
	password string,
) (func(*gocql.HostInfo) (gocql.Authenticator, error), error) {
	if !config.enabled {
		return nil, fmt.Errorf("Kerberos authentication is not enabled")
	}
	if config.credentialMode == kerberosCredentialNone {
		if err := config.finalize(username, password); err != nil {
			return nil, err
		}
	}
	krbConfig, err := krb5config.Load(config.configPath)
	if err != nil {
		return nil, fmt.Errorf("load Kerberos config %s: %w", config.configPath, err)
	}
	return func(host *gocql.HostInfo) (gocql.Authenticator, error) {
		return newKerberosAuthenticator(config, krbConfig, host)
	}, nil
}

func newKerberosAuthenticator(
	config kerberosConfig,
	krbConfig *krb5config.Config,

View on GitHub (pinned to c0390bff16)

Solutions

1. Set enabled=true on the kerberosConfig (or the corresponding config-file flag) before building the provider.
2. Check the config file/keys are parsed into the kerberosConfig that is actually passed to clusterConfig.
3. If Kerberos is not intended, remove the Kerberos settings or switch to PasswordAuthenticator.

Example fix

// before
clusterConfig(kerberosConfig{principal: "user@EXAMPLE.COM"}) // enabled defaults to false

// after
clusterConfig(kerberosConfig{enabled: true, principal: "user@EXAMPLE.COM", useKeytab: true, keytabPath: "/etc/krb5.keytab"})

if wantsKerberos(cfg) && !cfg.enabled {
	return errors.New("kerberos options present but enabled=false; set enabled=true")
}

When it happens

Trigger: Requesting a Kerberos gocql authenticator provider via newKerberosAuthProvider (through clusterConfig) while the kerberosConfig has enabled=false — e.g. Kerberos settings present in config but an enable flag not set, or the wrong config section parsed.

Common situations: Configuring Kerberos options (principal, keytab, etc.) but forgetting the master enable flag like `kerberos.enabled=true` in the driver config; typo in the config key so enabled stays false.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Kerberos authentication requires a credential cache, keytab,
• Kerberos keytab authentication requires a keytab path
• Kerberos credentials are not configured
• Kerberos keytab %s contains %d principals; configure kerbero
• Hive JWT authentication requires jwt or the JWT environment

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/5768d095468d33eb. Report an issue: GitHub.