Kerberos keytab authentication requires a keytab path

Error message

Kerberos keytab authentication requires a keytab path

What it means

selectKeytabCredential is invoked when keytab authentication was selected (useKeytab=true, or keytabPath set, or KRB5_*KTNAME env). If config.keytabPath is still empty after checking the KRB5_CLIENT_KTNAME and KRB5_KTNAME environment variables, the driver cannot locate a keytab file to load credentials from and aborts.

Source

Thrown at agents/drivers/cassandra-go/kerberos.go:198

		config.ccachePath = defaultKerberosCCachePath()
	}
	config.ccachePath, err = normalizeKerberosCachePath(config.ccachePath)
	if err != nil {
		return err
	}
	if err := requireRegularFile("Kerberos credential cache", config.ccachePath); err != nil {
		return err
	}
	config.credentialMode = kerberosCredentialCCache
	return nil
}

func (config *kerberosConfig) selectKeytabCredential(krbConfig *krb5config.Config) error {
	var err error
	if config.keytabPath == "" {
		config.keytabPath = firstNonEmpty(os.Getenv("KRB5_CLIENT_KTNAME"), os.Getenv("KRB5_KTNAME"))
		if config.keytabPath == "" {
			return fmt.Errorf("Kerberos keytab authentication requires a keytab path")
		}
	}
	config.keytabPath, err = normalizeKerberosFileReference(config.keytabPath)
	if err != nil {
		return err
	}
	if err := requireRegularFile("Kerberos keytab", config.keytabPath); err != nil {
		return err
	}
	if config.principal == "" {
		config.principal, err = principalFromKeytab(config.keytabPath)
		if err != nil {
			return err
		}
	}
	config.credentialUser, config.credentialRealm, err = splitKerberosPrincipal(
		config.principal,
		config.realm,

View on GitHub (pinned to c0390bff16)

Solutions

Set keytabPath in the kerberosConfig to an absolute path of an existing keytab file.
Export KRB5_CLIENT_KTNAME=/path/to/file.keytab (or KRB5_KTNAME) in the service environment.
Confirm the file exists and is readable by the process user (`ls -l` / `klist -kt`).

Example fix

// before
useKeytab: true // no keytabPath, no KRB5_CLIENT_KTNAME

// after
useKeytab: true,
keytabPath: "/etc/krb5.keytab"

Defensive patterns

Strategy: validation

Validate before calling

if cfg.useKeytab && cfg.keytabPath == "" && os.Getenv("KRB5_CLIENT_KTNAME") == "" && os.Getenv("KRB5_KTNAME") == "" {
	return errors.New("useKeytab is set but no keytab path or KRB5_CLIENT_KTNAME/KRB5_KTNAME provided")
}

Prevention

Always set keytabPath explicitly when useKeytab=true; don't rely on env inheritance.
Document required env vars (KRB5_CLIENT_KTNAME) in your deployment manifest/systemd unit.
Validate the keytab file exists at boot with os.Stat before building the cluster.

When it happens

Trigger: Calling finalize with useKeytab=true while keytabPath is empty and neither KRB5_CLIENT_KTNAME nor KRB5_KTNAME is set in the process environment.

Common situations: Setting `use_keytab = true` in the driver config but forgetting to set the keytab path; running under systemd/Docker where KRB5_CLIENT_KTNAME was not propagated; keytab path defined in a shell profile that the service does not source.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/369ae70f2e07c644. Report an issue: GitHub.