t8y2/dbx · error

Kerberos credentials are not configured

Error message

Kerberos credentials are not configured

What it means

The default branch of newKerberosClient's credential-mode switch is reached when config.credentialMode is neither ccache, keytab, nor password — i.e. credentials were never resolved. Normally finalize() prevents this, so this is a defensive error signaling the kerberosConfig was constructed without running credential resolution or with an unset/unknown mode.

Source

Thrown at agents/drivers/cassandra-go/kerberos.go:319

			return nil, fmt.Errorf("load Kerberos keytab %s: %w", config.keytabPath, err)
		}
		return krb5client.NewWithKeytab(
			config.credentialUser,
			config.credentialRealm,
			loadedKeytab,
			krbConfig,
			settings...,
		), nil
	case kerberosCredentialPassword:
		return krb5client.NewWithPassword(
			config.credentialUser,
			config.credentialRealm,
			config.password,
			krbConfig,
			settings...,
		), nil
	default:
		return nil, fmt.Errorf("Kerberos credentials are not configured")
	}
}

func (authenticator *kerberosAuthenticator) Challenge(request []byte) ([]byte, gocql.Authenticator, error) {
	switch authenticator.step {
	case 0:
		token, err := authenticator.initialToken()
		if err != nil {
			return nil, nil, err
		}
		authenticator.step = 1
		return token, authenticator, nil
	case 1:
		token, err := authenticator.securityLayerResponse(request)
		if err != nil {
			return nil, nil, err
		}
		authenticator.step = 2

View on GitHub (pinned to c0390bff16)

Solutions

1. Ensure the config flows through newKerberosAuthProvider (which calls finalize) rather than constructing authenticators directly.
2. Set one explicit credential source: ccachePath, keytabPath+useKeytab, or principal+password.
3. If you build the config manually, call the same credential-resolution path (finalize) before creating clients.

Example fix

// before: hand-rolled authenticator
auth := newKerberosAuthenticator(rawCfg, krbCfg, host) // credentialMode still none

// after
provider, err := newKerberosAuthProvider(cfg, username, password) // runs finalize

func validateCredentialMode(cfg kerberosConfig) error {
	switch cfg.credentialMode {
	case kerberosCredentialCCache, kerberosCredentialKeytab, kerberosCredentialPassword:
		return nil
	case kerberosCredentialNone:
		return errors.New("kerberos credential mode unresolved: provide ccache, keytab, or principal+password and run finalize")
	default:
		return fmt.Errorf("unknown kerberos credential mode %d", cfg.credentialMode)
	}
}

When it happens

Trigger: newKerberosAuthenticator -> newKerberosClient called with a kerberosConfig whose credentialMode is kerberosCredentialNone (or an invalid value) — e.g. a config passed around that skipped newKerberosAuthProvider's finalize step.

Common situations: Custom code building a kerberosConfig directly and invoking the authenticator without finalize; refactors that construct the provider differently; internal wiring bugs where enabled=true short-circuits differently.

Related errors

• Kerberos authentication requires a credential cache, keytab,
• Kerberos keytab authentication requires a keytab path
• Kerberos authentication is not enabled
• load Kerberos credential cache %s: %w
• create Kerberos client from credential cache: %w

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/2c045cdc54dbf16e. Report an issue: GitHub.