Kerberos requires SSPI, credential cache, keytab, or princip

Error message

Kerberos requires SSPI, credential cache, keytab, or principal and password

What it means

Final Kerberos validation: after realm/principal defaults are applied, the driver requires at least one usable credential mechanism — SSPI, a ticket cache (CCache), a keytab, or an explicit principal plus password. If none is present it rejects the config with this error.

Source

Thrown at agents/drivers/hive-go/config.go:954

	}
	if kerberos.UseSSPI {
		return nil
	}
	if kerberos.ConfigPath == "" {
		return errors.New("Kerberos requires krb5.conf or Windows SSPI")
	}
	if kerberos.ClientPrincipal == "" && !kerberos.UseTicketCache && !kerberos.UseKeytab {
		kerberos.ClientPrincipal = strings.TrimSpace(config.Username)
	}
	if kerberos.KeytabPath != "" {
		kerberos.UseKeytab = true
	}
	if kerberos.CCachePath != "" {
		kerberos.UseTicketCache = true
	}
	kerberos.Realm = firstNonEmpty(kerberos.Realm, realmFromPrincipal(kerberos.ClientPrincipal))
	if !kerberos.UseTicketCache && !kerberos.UseKeytab && (kerberos.ClientPrincipal == "" || kerberos.Password == "") {
		return errors.New("Kerberos requires SSPI, credential cache, keytab, or principal and password")
	}
	return nil
}

var jaasOptionPattern = regexp.MustCompile(`(?i)\b(principal|keytab|ticketcache|usekeytab|useticketcache)\s*=\s*("(?:\\.|[^"])*"|'(?:\\.|[^'])*'|[^\s;]+)`)

func applyKerberosJAASFile(config *kerberosConfig) error {
	contents, err := os.ReadFile(config.JAASConfigPath)
	if err != nil {
		return fmt.Errorf("read Kerberos JAAS config: %w", err)
	}
	text := string(contents)
	module := strings.Index(strings.ToLower(text), "krb5loginmodule")
	if module < 0 {
		return errors.New("Kerberos JAAS config contains no Krb5LoginModule")
	}
	block := text[module:]
	if end := strings.IndexByte(block, ';'); end >= 0 {

View on GitHub (pinned to c0390bff16)

Solutions

Set kerberos.ClientPrincipal and kerberos.Password for principal/password auth.
Set kerberos.KeytabPath (which forces UseKeytab) for headless keytab auth.
Set kerberos.CCachePath or UseTicketCache = true to use an existing credential cache.
On Windows, set kerberos.UseSSPI = true.

Example fix

// before
kerberos := &KerberosConfig{ConfigPath: "/etc/krb5.conf"}
// after
kerberos := &KerberosConfig{ConfigPath: "/etc/krb5.conf", KeytabPath: "/etc/security/hive.keytab", ClientPrincipal: "hive@EXAMPLE.COM"}

Defensive patterns

Strategy: validation

Validate before calling

if !kerberos.UseSSPI && !kerberos.UseTicketCache && !kerberos.UseKeytab &&
	(kerberos.ClientPrincipal == "" || kerberos.Password == "") {
	return fmt.Errorf("Kerberos needs SSPI, ticket cache, keytab, or principal+password")
}

Prevention

For services, always prefer keytab auth; for workstations, SSPI or ticket cache (kinit)
Validate the credential combination at config-load time
Keep secrets (passwords) out of plain config; inject them from a secret manager

When it happens

Trigger: Enabling Kerberos auth with a ConfigPath set but leaving UseSSPI=false, UseTicketCache=false, UseKeytab=false, and either ClientPrincipal or Password empty.

Common situations: Interactive login style copied to a headless service without keytab/password; assuming ticket cache exists but KRB5CCNAME is unset and CCachePath empty; password stored in a secret manager but never populated into config.

Related errors

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/75ba985109f7e4bc. Report an issue: GitHub.