Kerberos authentication requires a credential cache, keytab,

Error message

Kerberos authentication requires a credential cache, keytab, or principal and password

What it means

This error comes from kerberosConfig.finalize in the cassandra-go driver. After Kerberos is enabled, finalize tries in order: explicit ticket cache, explicit keytab, ccache path, keytab path, principal+password, then KRB5CCNAME/default cache, then KRB5_CLIENT_KTNAME/KRB5_KTNAME. If none of these yields usable credentials, it refuses to build an authenticator because gocql Kerberos auth needs some credential source to authenticate to Cassandra.

Source

Thrown at agents/drivers/cassandra-go/kerberos.go:174

		if config.ccachePath == "" {
			defaultCache := defaultKerberosCCachePath()
			if path, normalizeErr := normalizeKerberosCachePath(defaultCache); normalizeErr == nil {
				if info, statErr := os.Stat(path); statErr == nil && info.Mode().IsRegular() {
					config.ccachePath = defaultCache
				}
			}
		}
		if config.ccachePath != "" {
			return config.selectCCacheCredential()
		}
	}
	if !config.useKeytabSet {
		config.keytabPath = firstNonEmpty(os.Getenv("KRB5_CLIENT_KTNAME"), os.Getenv("KRB5_KTNAME"))
		if config.keytabPath != "" {
			return config.selectKeytabCredential(krbConfig)
		}
	}
	return fmt.Errorf("Kerberos authentication requires a credential cache, keytab, or principal and password")
}

func (config *kerberosConfig) selectCCacheCredential() error {
	var err error
	if config.ccachePath == "" {
		config.ccachePath = defaultKerberosCCachePath()
	}
	config.ccachePath, err = normalizeKerberosCachePath(config.ccachePath)
	if err != nil {
		return err
	}
	if err := requireRegularFile("Kerberos credential cache", config.ccachePath); err != nil {
		return err
	}
	config.credentialMode = kerberosCredentialCCache
	return nil
}

View on GitHub (pinned to c0390bff16)

Solutions

Provide credentials: run `kinit user@REALM` (or ensure KRB5CCNAME points to a valid ccache) before starting the process.
Set useKeytab=true and keytabPath (or export KRB5_CLIENT_KTNAME) pointing to an existing keytab file.
Pass both principal (e.g. user@REALM) and password through the driver username/password so finalize takes the password credential path.
Verify with `klist` and check env vars KRB5CCNAME, KRB5_CLIENT_KTNAME, KRB5_KTNAME are visible to the process.

Example fix

// before (no credential source found)
clusterConfig(kerberosConfig{enabled: true})

// after (explicit keytab)
clusterConfig(kerberosConfig{enabled: true, useKeytab: true, keytabPath: "/etc/security/cassandra.keytab", principal: "cassandra@EXAMPLE.COM"})

Defensive patterns

Strategy: validation

Validate before calling

func kerberosCredsAvailable() error {
	if os.Getenv("KRB5CCNAME") != "" { return nil }
	if _, err := os.Stat(defaultCCachePath()); err == nil { return nil }
	if p := firstNonEmpty(os.Getenv("KRB5_CLIENT_KTNAME"), os.Getenv("KRB5_KTNAME")); p != "" {
		if _, err := os.Stat(p); err == nil { return nil }
	}
	return errors.New("no Kerberos ccache or keytab; run kinit or set a keytab path")
}

Prevention

Run kinit (or use a keytab with k5start/krb5-auth-dialog) as a startup dependency of the service.
In containers, mount the keytab and set KRB5_CLIENT_KTNAME explicitly instead of relying on ambient caches.
Smoke-test `klist` in your readiness probe or entrypoint before connecting.

When it happens

Trigger: Calling newKerberosAuthProvider (via clusterConfig) with config.enabled=true but: useTicketCache/useKeytab false or their selected paths empty, ccachePath and keytabPath unset, principal or password empty, KRB5CCNAME unset with no default cache file at /tmp/krb5cc_<uid>, and KRB5_CLIENT_KTNAME/KRB5_KTNAME unset.

Common situations: Running the app in a container or CI where no kinit was performed and no keytab was mounted; having only KRB5_CONFIG set but no credential material; setting a principal without a password and no cache/keytab; stale KRB5CCNAME pointing nowhere.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/d237a9dc2412aeeb. Report an issue: GitHub.