What causes "Kerberos login failed: %w" in t8y2/dbx?

Inspect the wrapped cause: fix clock skew (`ntpdate`/chrony), KDC reachability (DNS SRV, /etc/krb5.conf realms), or credentials accordingly.

t8y2/dbx · error

Kerberos login failed: %w

Error message

Kerberos login failed: %w

What it means

newKerberosAuthenticator creates a krb5 client and performs the Kerberos login (obtaining initial credentials from the ccache, keytab, or password). If client.Login() fails, the client is destroyed and the underlying go-krb5 error (pre-auth failure, clock skew, KDC unreachable, bad keytab entry) is wrapped with this message.

Source

Thrown at agents/drivers/cassandra-go/kerberos.go:259

		return nil, fmt.Errorf("load Kerberos config %s: %w", config.configPath, err)
	}
	return func(host *gocql.HostInfo) (gocql.Authenticator, error) {
		return newKerberosAuthenticator(config, krbConfig, host)
	}, nil
}

func newKerberosAuthenticator(
	config kerberosConfig,
	krbConfig *krb5config.Config,
	host *gocql.HostInfo,
) (gocql.Authenticator, error) {
	client, err := newKerberosClient(config, krbConfig)
	if err != nil {
		return nil, err
	}
	if err := client.Login(); err != nil {
		client.Destroy()
		return nil, fmt.Errorf("Kerberos login failed: %w", err)
	}
	serverName, err := kerberosServerName(config, host)
	if err != nil {
		client.Destroy()
		return nil, err
	}
	servicePrincipal := config.serviceName + "/" + serverName
	ticket, sessionKey, err := client.GetServiceTicket(servicePrincipal)
	if err != nil {
		client.Destroy()
		return nil, fmt.Errorf("get Kerberos service ticket for %s: %w", servicePrincipal, err)
	}
	clientName := client.Credentials.CName()
	clientName.NameString = append([]string(nil), clientName.NameString...)
	authenticator := &kerberosAuthenticator{
		domain:          strings.Clone(client.Credentials.Domain()),
		clientName:      clientName,
		ticket:          ticket,

View on GitHub (pinned to c0390bff16)

Solutions

Inspect the wrapped cause: fix clock skew (`ntpdate`/chrony), KDC reachability (DNS SRV, /etc/krb5.conf realms), or credentials accordingly.
Re-extract the keytab on the KDC (`ktadd`) for the exact principal in use, or re-run kinit with the correct password.
Test outside the app: `kinit -kt /path/keytab principal@REALM` to isolate the failure.
Ensure the ccache (if used) holds fresh tickets (`klist -f`), re-run `kinit` if expired.

Example fix

// before: stale keytab entry
// after: re-extract matching principal
// on KDC: kadmin: ktadd -k /etc/security/cassandra.keytab cassandra/host@REALM

Defensive patterns

Strategy: retry

Validate before calling

// preflight outside the app path:
// kinit -kt $KEYTAB $PRINCIPAL || echo "keytab login failed"
// chronyc tracking | grep -i offset  # keep skew < 5 min

Try / catch

provider, err := newKerberosAuthProvider(cfg, user, pass)
if err != nil {
	if strings.Contains(err.Error(), "login failed") {
		// inspect wrapped cause: clock skew, KDC unreachable, bad key => alert, backoff, retry
	}
	return err
}

Prevention

Run NTP/chrony on all hosts to avoid clock-skew rejections.
Rotate keytabs by re-extracting on the KDC before passwords expire.
Monitor KDC availability and DNS resolution of realm KDCs from the client network.

When it happens

Trigger: Any failure of krb5client.Login() at authentication time: wrong password for the principal, keytab entry not matching the principal/enctype, KDC unreachable, clock skew beyond allowed skew, expired/bad ccache credentials.

Common situations: Keytab extracted for the wrong principal; password rotated after deployment; container clock drift causing 'clock skew too great'; KDC/DNS misconfiguration (cannot resolve realm KDC).

Related errors

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/6885118b9d852044. Report an issue: GitHub.