Kerberos JAAS config contains no Krb5LoginModule

Error message

Kerberos JAAS config contains no Krb5LoginModule

What it means

When a JAAS config path is configured for Kerberos, applyKerberosJAASFile reads the file and scans it for a Krb5LoginModule entry, since only that module carries the principal/keytab/ticketCache options this driver understands. If the file text does not contain the string "krb5loginmodule" (case-insensitive), the file is not usable for Kerberos and this error is thrown. Note the module must appear before any ';' character for its options to be parsed.

Source

Thrown at agents/drivers/argo-go/config.go:966

	}
	kerberos.Realm = firstNonEmpty(kerberos.Realm, realmFromPrincipal(kerberos.ClientPrincipal))
	if !kerberos.UseTicketCache && !kerberos.UseKeytab && (kerberos.ClientPrincipal == "" || kerberos.Password == "") {
		return errors.New("Kerberos requires SSPI, credential cache, keytab, or principal and password")
	}
	return nil
}

var jaasOptionPattern = regexp.MustCompile(`(?i)\b(principal|keytab|ticketcache|usekeytab|useticketcache)\s*=\s*("(?:\\.|[^"])*"|'(?:\\.|[^'])*'|[^\s;]+)`)

func applyKerberosJAASFile(config *kerberosConfig) error {
	contents, err := os.ReadFile(config.JAASConfigPath)
	if err != nil {
		return fmt.Errorf("read Kerberos JAAS config: %w", err)
	}
	text := string(contents)
	module := strings.Index(strings.ToLower(text), "krb5loginmodule")
	if module < 0 {
		return errors.New("Kerberos JAAS config contains no Krb5LoginModule")
	}
	block := text[module:]
	if end := strings.IndexByte(block, ';'); end >= 0 {
		block = block[:end]
	}
	for _, match := range jaasOptionPattern.FindAllStringSubmatch(block, -1) {
		key := strings.ToLower(match[1])
		value := decodeJAASValue(match[2])
		switch key {
		case "principal":
			if config.ClientPrincipal == "" {
				config.ClientPrincipal = value
			}
		case "keytab":
			if config.KeytabPath == "" {
				config.KeytabPath = value
			}
		case "ticketcache":

View on GitHub (pinned to c0390bff16)

Solutions

Edit the JAAS file to include a Krb5LoginModule entry, e.g. 'Client { com.sun.security.auth.module.Krb5LoginModule required useKeyTab=true keyTab="/path/keytab" principal="user@REALM"; };'.
Verify the JAASConfigPath points to the intended jaas.conf, not krb5.conf or another config file.
Ensure the Krb5LoginModule block is not commented out and its text appears before the terminating ';'.

Example fix

// before (jaas.conf)
Client { com.sun.security.auth.module.UnixLoginModule required; };
// after
Client { com.sun.security.auth.module.Krb5LoginModule required useKeyTab=true keyTab="/etc/security/keytabs/hive.keytab" principal="hive@EXAMPLE.COM"; };

Defensive patterns

Strategy: validation

Validate before calling

func validateJAASFile(path string) error {
	b, err := os.ReadFile(path)
	if err != nil { return err }
	if !strings.Contains(strings.ToLower(string(b)), "krb5loginmodule") {
		return fmt.Errorf("%s has no Krb5LoginModule block", path)
	}
	return nil
}
// call before setting JAASConfigPath

Try / catch

if err := driver.Connect(cfg); err != nil {
	if strings.Contains(err.Error(), "no Krb5LoginModule") {
		return fmt.Errorf("JAAS file %s is not a Kerberos JAAS config: %w", jaasPath, err)
	}
	return err
}

Prevention

Keep jaas.conf and krb5.conf as distinct files with obvious names; never cross-wire their paths.
Include the full 'com.sun.security.auth.module.Krb5LoginModule required ...;' block in templates.
Ensure the Krb5LoginModule block is not commented out and ends with ';' after its options.
Validate the JAAS file in CI or at startup with a simple substring check.

When it happens

Trigger: Pointing kerberos.JAASConfigPath (or -Djava.security.auth.login.config via JVM options) at a JAAS file that defines other login modules (e.g. com.sun.security.auth.module.UnixLoginModule, LdapLoginModule) but no com.sun.security.auth.module.Krb5LoginModule; a typo like 'Krb5Loginmodule' still matches due to case-insensitivity, so mostly this means the wrong file or a placeholder file was supplied.

Common situations: Reusing a JAAS file from a non-Kerberos service; copying a template with the Krb5LoginModule block commented out or not yet filled in; passing the wrong path (e.g. a krb5.conf instead of jaas.conf); empty or truncated JAAS file.

Related errors

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/d374a0157fb1cbd5. Report an issue: GitHub.