t8y2/dbx · error

Kerberos ticket cache path is empty

Error message

Kerberos ticket cache path is empty

What it means

normalizeKerberosCachePath was given an empty (or whitespace-only) ticket-cache path. This library requires an explicit FILE credential-cache path to authenticate with a ccache; nothing was configured (no TicketCache option, no KRB5CCNAME-resolvable default).

Source

Thrown at agents/drivers/cassandra-go/kerberos.go:515

	}
	return nil
}

func javaSystemProperty(name string) string {
	pattern := regexp.MustCompile(`(?:^|\s)-D` + regexp.QuoteMeta(name) + `=(?:"([^"]*)"|'([^']*)'|(\S+))`)
	for _, environmentName := range []string{"JAVA_TOOL_OPTIONS", "_JAVA_OPTIONS", "JDK_JAVA_OPTIONS"} {
		match := pattern.FindStringSubmatch(os.Getenv(environmentName))
		if len(match) == 4 {
			return firstNonEmpty(match[1], match[2], match[3])
		}
	}
	return ""
}

func normalizeKerberosCachePath(raw string) (string, error) {
	value := strings.TrimSpace(raw)
	if value == "" {
		return "", fmt.Errorf("Kerberos ticket cache path is empty")
	}
	if separator := strings.IndexByte(value, ':'); separator > 0 && !isWindowsDrivePath(value) {
		cacheType := strings.ToUpper(value[:separator])
		if cacheType != "FILE" {
			return "", fmt.Errorf("Kerberos credential cache type %s is not supported; use a FILE cache or keytab", cacheType)
		}
		value = value[separator+1:]
	}
	path, err := normalizeLocalFilePath(value)
	if err != nil {
		return "", fmt.Errorf("invalid Kerberos credential cache path: %w", err)
	}
	return path, nil
}

func isWindowsDrivePath(value string) bool {
	return len(value) >= 3 && ((value[0] >= 'A' && value[0] <= 'Z') || (value[0] >= 'a' && value[0] <= 'z')) &&
		value[1] == ':' && (value[2] == '\\' || value[2] == '/')

View on GitHub (pinned to c0390bff16)

Solutions

1. Set the ticket cache path explicitly in the driver config (or JAAS `TicketCache=` option) to the ccache file, e.g. /tmp/krb5cc_1000.
2. Ensure KRB5CCNAME points to a FILE cache and run `kinit` so the file exists.
3. If keytab auth is intended instead, clear the ccache setting and configure keyTab/principal so the keytab path is selected.

Example fix

// before
cluster.KerberosTicketCachePath = os.Getenv("KRB5CCNAME") // ""
// after
cluster.KerberosTicketCachePath = "/tmp/krb5cc_1000" // or run kinit first so KRB5CCNAME resolves

func ensureCCache(path string) (string, error) {
	p := strings.TrimSpace(path)
	if p == "" { p = os.Getenv("KRB5CCNAME") }
	if p == "" {
		u, err := user.Current()
		if err != nil { return "", fmt.Errorf("no ccache path available") }
		p = filepath.Join(os.TempDir(), "krb5cc_"+u.Uid)
	}
	if _, err := os.Stat(strings.TrimPrefix(p, "FILE:")); err != nil {
		return "", fmt.Errorf("ccache %s missing; run kinit", p)
	}
	return p, nil
}

if err := client.Finalize(); err != nil {
	if strings.Contains(err.Error(), "ticket cache path is empty") {
		log.Fatal("set ticketcache path or run kinit so KRB5CCNAME resolves")
	}
	return err
}

When it happens

Trigger: selectCCacheCredential / finalize resolve the ccache path (config option, KRB5CCNAME, or default /tmp/krb5cc_<uid>) and the resulting raw string trims to empty.

Common situations: KRB5CCNAME is set to an empty string; the ticketcache config/JAAS option is `ticketcache=""`; running in a container where user.Current() fails so the default /tmp/krb5cc_<uid> cannot be computed and no kinit has ever run.

Related errors

• remote file URI hosts are not supported: %s
• invalid Kerberos credential cache path: %w
• invalid usekrb5 option: %w
• invalid disablepafxfast option: %w
• invalid usekeytab option: %w

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/596933ce0a3f4a99. Report an issue: GitHub.