t8y2/dbx · error

Kerberos credential cache type %s is not supported; use a FI

Error message

Kerberos credential cache type %s is not supported; use a FILE cache or keytab

What it means

The ticket cache path used a cache-type prefix other than FILE (e.g. KEYRING:, DIR:, MEMORY:, KCM:). This library only supports FILE-format credential caches (or keytabs); it parses `TYPE:path` and rejects any TYPE that is not FILE. Windows drive paths (C:\...) are exempted from prefix interpretation.

Source

Thrown at agents/drivers/cassandra-go/kerberos.go:520

	pattern := regexp.MustCompile(`(?:^|\s)-D` + regexp.QuoteMeta(name) + `=(?:"([^"]*)"|'([^']*)'|(\S+))`)
	for _, environmentName := range []string{"JAVA_TOOL_OPTIONS", "_JAVA_OPTIONS", "JDK_JAVA_OPTIONS"} {
		match := pattern.FindStringSubmatch(os.Getenv(environmentName))
		if len(match) == 4 {
			return firstNonEmpty(match[1], match[2], match[3])
		}
	}
	return ""
}

func normalizeKerberosCachePath(raw string) (string, error) {
	value := strings.TrimSpace(raw)
	if value == "" {
		return "", fmt.Errorf("Kerberos ticket cache path is empty")
	}
	if separator := strings.IndexByte(value, ':'); separator > 0 && !isWindowsDrivePath(value) {
		cacheType := strings.ToUpper(value[:separator])
		if cacheType != "FILE" {
			return "", fmt.Errorf("Kerberos credential cache type %s is not supported; use a FILE cache or keytab", cacheType)
		}
		value = value[separator+1:]
	}
	path, err := normalizeLocalFilePath(value)
	if err != nil {
		return "", fmt.Errorf("invalid Kerberos credential cache path: %w", err)
	}
	return path, nil
}

func isWindowsDrivePath(value string) bool {
	return len(value) >= 3 && ((value[0] >= 'A' && value[0] <= 'Z') || (value[0] >= 'a' && value[0] <= 'z')) &&
		value[1] == ':' && (value[2] == '\\' || value[2] == '/')
}

func normalizeKerberosFileReference(raw string) (string, error) {
	value := strings.TrimSpace(raw)
	if strings.HasPrefix(strings.ToUpper(value), "FILE:") {

View on GitHub (pinned to c0390bff16)

Solutions

1. Switch to a FILE cache: `export KRB5CCNAME=FILE:/tmp/krb5cc_1000` and run `kinit -c FILE:/tmp/krb5cc_1000`.
2. In krb5.conf, change default_ccache_name to a FILE path (e.g. /tmp/krb5cc_%{uid}).
3. Use keytab authentication instead (keyTab + principal in config) to bypass the ccache entirely.
4. On Windows, keep normal drive-letter paths (C:\...) which are correctly not treated as cache-type prefixes.

Example fix

// before
export KRB5CCNAME=KEYRING:persistent:1000
// after
export KRB5CCNAME=FILE:/tmp/krb5cc_1000 && kinit -c FILE:/tmp/krb5cc_1000

func ensureFileCCache(name string) error {
	if i := strings.IndexByte(name, ':'); i > 0 && !regexp.MustCompile(`^[A-Za-z]:[\\/]`).MatchString(name) {
		if !strings.EqualFold(name[:i], "FILE") {
			return fmt.Errorf("ccache type %s unsupported; use FILE:/path", name[:i])
		}
	}
	return nil
}

if err := client.Finalize(); err != nil {
	if strings.Contains(err.Error(), "is not supported; use a FILE cache") {
		log.Fatalf("KRB5CCNAME uses unsupported cache type; set KRB5CCNAME=FILE:/tmp/krb5cc_$(id -u)")
	}
	return err
}

When it happens

Trigger: KRB5CCNAME or the ticketcache config option is set to something like `DIR::/run/user/1000/krb5cc`, `KEYRING:persistent:1000`, `KCM:1000`, or `MEMORY:`; normalizeKerberosCachePath splits on the first ':' and rejects the uppercase prefix.

Common situations: Modern Linux distros default KRB5CCNAME to KEYRING: or DIR: caches; systemd user sessions use DIR:; kinit in containers configured with KCM. The driver cannot read these formats.

Related errors

• invalid usekrb5 option: %w
• invalid disablepafxfast option: %w
• invalid usekeytab option: %w
• invalid useticketcache option: %w
• Cassandra secure connect bundles cannot be combined with Ker

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/256d9da80c71aff5. Report an issue: GitHub.