t8y2/dbx · error

Kerberos requires krb5.conf or Windows SSPI

Error message

Kerberos requires krb5.conf or Windows SSPI

What it means

During Kerberos configuration validation, if SSPI is not enabled (Windows-only) and no krb5.conf path was supplied, the driver cannot initialize Kerberos and rejects the config. Kerberos needs either the MIT krb5 configuration file (non-Windows or explicit path) or the Windows SSPI path. This is a config-completeness check thrown before any network connection is attempted.

Source

Thrown at agents/drivers/hive-go/config.go:941

	if kerberos.ConfigPath == "" {
		if candidate := defaultKerberosConfigPath(); fileExists(candidate) {
			kerberos.ConfigPath = candidate
		}
	}
	if !kerberos.UseTicketCache && kerberos.CCachePath == "" {
		if candidate := defaultKerberosCCachePath(); fileExists(candidate) {
			kerberos.CCachePath = candidate
			kerberos.UseTicketCache = true
		}
	}
	if runtime.GOOS == "windows" && kerberos.ConfigPath == "" && kerberos.KeytabPath == "" && kerberos.CCachePath == "" {
		kerberos.UseSSPI = true
	}
	if kerberos.UseSSPI {
		return nil
	}
	if kerberos.ConfigPath == "" {
		return errors.New("Kerberos requires krb5.conf or Windows SSPI")
	}
	if kerberos.ClientPrincipal == "" && !kerberos.UseTicketCache && !kerberos.UseKeytab {
		kerberos.ClientPrincipal = strings.TrimSpace(config.Username)
	}
	if kerberos.KeytabPath != "" {
		kerberos.UseKeytab = true
	}
	if kerberos.CCachePath != "" {
		kerberos.UseTicketCache = true
	}
	kerberos.Realm = firstNonEmpty(kerberos.Realm, realmFromPrincipal(kerberos.ClientPrincipal))
	if !kerberos.UseTicketCache && !kerberos.UseKeytab && (kerberos.ClientPrincipal == "" || kerberos.Password == "") {
		return errors.New("Kerberos requires SSPI, credential cache, keytab, or principal and password")
	}
	return nil
}

var jaasOptionPattern = regexp.MustCompile(`(?i)\b(principal|keytab|ticketcache|usekeytab|useticketcache)\s*=\s*("(?:\\.|[^"])*"|'(?:\\.|[^'])*'|[^\s;]+)`)

View on GitHub (pinned to c0390bff16)

Solutions

1. Set kerberos.ConfigPath to a valid krb5.conf path (e.g. /etc/krb5.conf).
2. On Windows, set kerberos.UseSSPI = true to use integrated Windows authentication.
3. Ship a krb5.conf in the container/image and point ConfigPath at it, or set the KRB5_CONFIG convention path.

Example fix

// before
kerberos := &KerberosConfig{ClientPrincipal: "hive@EXAMPLE.COM"}
// after
kerberos := &KerberosConfig{ConfigPath: "/etc/krb5.conf", ClientPrincipal: "hive@EXAMPLE.COM"}

if kerberos.UseSSPI == false && kerberos.ConfigPath == "" {
	return fmt.Errorf("set kerberos.ConfigPath to a krb5.conf before connecting")
}

When it happens

Trigger: Building a Hive config with kerberos auth enabled but leaving kerberos.ConfigPath empty while kerberos.UseSSPI is false — e.g. running on Linux with no KRB5_CONFIG-derived ConfigPath set.

Common situations: Deploying to Linux after developing on Windows where SSPI was used implicitly; forgetting to ship krb5.conf with the container; ConfigPath pointing to a value only set via env var that is not propagated.

Related errors

• Kerberos requires SSPI, credential cache, keytab, or princip
• Kerberos JAAS config contains no Krb5LoginModule
• token contains trailing data
• Kerberos requires krb5.conf or Windows SSPI
• Kerberos requires SSPI, credential cache, keytab, or princip

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/d69eede3183a3534. Report an issue: GitHub.