Kerberos requires SSPI, credential cache, keytab, or princip

Error message

Kerberos requires SSPI, credential cache, keytab, or principal and password

What it means

With Kerberos enabled, the driver must end up with at least one usable credential source: Windows SSPI, a ticket cache (UseTicketCache/CCachePath), a keytab (UseKeytab/KeytabPath), or an explicit client principal plus password. If none of these are satisfied after applying JAAS files, environment variables (KRB5CCNAME, KRB5_CLIENT_KTNAME), and defaults, finalizeKerberosConfig returns this error. This mirrors the Java Hive JDBC driver's requirement that a UGI login has some credential mechanism.

Source

Thrown at agents/drivers/argo-go/config.go:951

	}
	if kerberos.UseSSPI {
		return nil
	}
	if kerberos.ConfigPath == "" {
		return errors.New("Kerberos requires krb5.conf or Windows SSPI")
	}
	if kerberos.ClientPrincipal == "" && !kerberos.UseTicketCache && !kerberos.UseKeytab {
		kerberos.ClientPrincipal = strings.TrimSpace(config.Username)
	}
	if kerberos.KeytabPath != "" {
		kerberos.UseKeytab = true
	}
	if kerberos.CCachePath != "" {
		kerberos.UseTicketCache = true
	}
	kerberos.Realm = firstNonEmpty(kerberos.Realm, realmFromPrincipal(kerberos.ClientPrincipal))
	if !kerberos.UseTicketCache && !kerberos.UseKeytab && (kerberos.ClientPrincipal == "" || kerberos.Password == "") {
		return errors.New("Kerberos requires SSPI, credential cache, keytab, or principal and password")
	}
	return nil
}

var jaasOptionPattern = regexp.MustCompile(`(?i)\b(principal|keytab|ticketcache|usekeytab|useticketcache)\s*=\s*("(?:\\.|[^"])*"|'(?:\\.|[^'])*'|[^\s;]+)`)

func applyKerberosJAASFile(config *kerberosConfig) error {
	contents, err := os.ReadFile(config.JAASConfigPath)
	if err != nil {
		return fmt.Errorf("read Kerberos JAAS config: %w", err)
	}
	text := string(contents)
	module := strings.Index(strings.ToLower(text), "krb5loginmodule")
	if module < 0 {
		return errors.New("Kerberos JAAS config contains no Krb5LoginModule")
	}
	block := text[module:]
	if end := strings.IndexByte(block, ';'); end >= 0 {

View on GitHub (pinned to c0390bff16)

Solutions

Run kinit (or ensure KRB5CCNAME points to a valid ccache) so the driver can use the ticket cache.
Provide a keytab: set kerberos.KeytabPath (or KRB5_CLIENT_KTNAME) with a keytab for the client principal.
Set both a client principal (config.Username, e.g. user@REALM) and password in the config.
Add principal/keytab/ticketCache options to the Krb5LoginModule block in the JAAS config file.
On Windows, use SSPI (leave other options unset on a domain-joined machine).

Example fix

// before
kcfg := kerberosConfig{Enabled: true} // no credentials anywhere
// after
kcfg := kerberosConfig{Enabled: true, KeytabPath: "/etc/security/keytabs/client.keytab", ClientPrincipal: "hive@EXAMPLE.COM"}
// or run: kinit hive@EXAMPLE.COM

Defensive patterns

Strategy: validation

Validate before calling

func hasKerberosCredentialSource(username, password, keytab, ccache string, useTicketCache, useKeytab, useSSPI bool) error {
	if useSSPI { return nil }
	if useKeytab || keytab != "" { return nil }
	if useTicketCache || ccache != "" { return nil }
	if strings.TrimSpace(username) != "" && password != "" { return nil }
	return errors.New("no kerberos credential: need keytab, ccache (kinit), or principal+password")
}
// also verify ccache exists: os.Stat(ccache)

Try / catch

if err := driver.Connect(cfg); err != nil {
	if strings.Contains(err.Error(), "principal and password") {
		// surface actionable guidance: run kinit or configure keytab
		return fmt.Errorf("kerberos credentials missing: run kinit or set keytab path: %w", err)
	}
	return err
}

Prevention

Run kinit (or a keytab-based kinit -kt) in the service's startup script before connecting.
Set KRB5_CLIENT_KTNAME for keytab auth in Kubernetes/systemd units.
Verify ~/krb5cc or KRB5CCNAME target exists and is fresh (tokens expire).
Document required Kerberos env for the service account in deployment docs.

When it happens

Trigger: Enabling Kerberos with a krb5.conf present but no principal, no password, no keytab, and no ccache — e.g. config.Username empty and no UseTicketCache/UseKeytab flags, and the JAAS config (if any) provided no principal/keytab/ticketCache options.

Common situations: Setting kerberos=true but forgetting kinit (no ~/krb5cc cache exists) on a service account without a keytab; JAAS file present but with a non-Krb5 module so no options were extracted; username empty because auth was expected to come purely from the environment; migration from password auth where Password was cleared.

Related errors

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/f95297d147a5b25f. Report an issue: GitHub.