t8y2/dbx · error

Kerberos keytab %s contains no principals

Error message

Kerberos keytab %s contains no principals

What it means

principalFromKeytab returns this when the keytab parsed successfully but contains zero entries, so no principal can be derived from it. Since automatic principal discovery is impossible, credential selection fails.

Source

Thrown at agents/drivers/cassandra-go/kerberos.go:582

	return value, realm, nil
}

func principalFromKeytab(path string) (string, error) {
	loadedKeytab, err := keytab.Load(path)
	if err != nil {
		return "", fmt.Errorf("load Kerberos keytab %s: %w", path, err)
	}
	principals := map[string]struct{}{}
	for _, entry := range loadedKeytab.Entries {
		principals[entry.Principal.String()] = struct{}{}
	}
	if len(principals) != 1 {
		return "", fmt.Errorf("Kerberos keytab %s contains %d principals; configure kerberosprincipal explicitly", path, len(principals))
	}
	for principal := range principals {
		return principal, nil
	}
	return "", fmt.Errorf("Kerberos keytab %s contains no principals", path)
}

func defaultKerberosConfigPath() string {
	if runtime.GOOS == "windows" {
		if windowsDirectory := os.Getenv("WINDIR"); windowsDirectory != "" {
			return filepath.Join(windowsDirectory, "krb5.ini")
		}
	}
	return "/etc/krb5.conf"
}

func defaultKerberosCCachePath() string {
	if value := os.Getenv("KRB5CCNAME"); value != "" {
		return value
	}
	currentUser, err := user.Current()
	if err == nil && currentUser.Uid != "" {
		return filepath.Join(os.TempDir(), "krb5cc_"+currentUser.Uid)

View on GitHub (pinned to c0390bff16)

Solutions

1. Regenerate the keytab with proper entries (ktutil addent + wkt, or ktpass/kadmin ktadd).
2. Verify with klist -k <path> that at least one entry exists.
3. Set kerberosprincipal explicitly if you want the driver to proceed regardless, though authentication will still fail with an empty keytab — fixing the file is required.

Example fix

// before
$ klist -k /path/to.keytab  ->  (no entries)
// after (regenerate)
$ ktutil: addent -password -p svc-cassandra@EXAMPLE.COM -k 1 -en aes256-cts-hmac-sha1-96
$ ktutil: wkt /path/to.keytab

info, err := os.Stat(keytabPath)
if err != nil { return err }
if info.Size() == 0 { return fmt.Errorf("keytab %s is empty", keytabPath) }
out, _ := exec.Command("klist", "-k", keytabPath).Output()
if len(strings.Fields(string(out))) == 0 { return fmt.Errorf("keytab has no entries") }

if err != nil && strings.Contains(err.Error(), "contains no principals") {
    return fmt.Errorf("keytab %s invalid; regenerate with ktutil/ktpass", keytabPath)
}

When it happens

Trigger: selectKeytabCredential runs with kerberosprincipal unset and loadedKeytab.Entries is empty (the for-loop over principals never executes, falling through to the final return).

Common situations: A keytab file created by an interrupted or failed ktpass/ktutil export; a keytab that had its entries removed with ktutil remove_entry; an empty or placeholder file that still parses as a valid keytab; provisioning scripts that create the file before populating it.

Related errors

• Kerberos requires SSPI, credential cache, keytab, or princip
• ZooKeeper session closed because SASL authentication is requ
• Kerberos requires krb5.conf or Windows SSPI
• Kerberos requires SSPI, credential cache, keytab, or princip
• Kerberos JAAS config contains no Krb5LoginModule

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/3d2bc3d363319139. Report an issue: GitHub.