t8y2/dbx · error

load Kerberos config %s: %w

Error message

load Kerberos config %s: %w

What it means

finalize throws this when krb5config.Load fails to parse the krb5.conf file at config.configPath. The file exists and is a regular file (requireRegularFile already passed) but its contents are invalid — bad sections, malformed relations, or unsupported syntax — so the driver cannot build Kerberos realm/KDC mappings.

Source

Thrown at agents/drivers/cassandra-go/kerberos.go:115

		if err := config.applyJAASConfig(path); err != nil {
			return err
		}
	}
	config.applyKerberosConfigEnvironment()
	if config.configPath == "" {
		config.configPath = defaultKerberosConfigPath()
	}
	path, err := normalizeLocalFilePath(firstPathListEntry(config.configPath))
	if err != nil {
		return fmt.Errorf("invalid Kerberos config path: %w", err)
	}
	config.configPath = path
	if err := requireRegularFile("Kerberos config", config.configPath); err != nil {
		return err
	}
	krbConfig, err := krb5config.Load(config.configPath)
	if err != nil {
		return fmt.Errorf("load Kerberos config %s: %w", config.configPath, err)
	}
	if config.serviceName == "" {
		config.serviceName = "cassandra"
	}
	if !kerberosQOPIncludesAuth(config.qop) {
		return fmt.Errorf("Cassandra Kerberos currently supports SASL QOP auth only, got %s", config.qop)
	}
	config.qop = "auth"
	if config.principal == "" {
		config.principal = strings.TrimSpace(username)
	}
	if config.password == "" {
		config.password = password
	}
	if config.useTicketCache {
		return config.selectCCacheCredential()
	}
	if config.useKeytab {

View on GitHub (pinned to c0390bff16)

Solutions

1. Validate the krb5.conf named in the error (e.g. with `krb5-config` or `kinit -t`-style tools / k5test) and fix the syntax error it reports.
2. Restore a known-good krb5.conf from your Kerberos admin or package defaults.
3. Check for BOM/CRLF corruption if the file was edited on Windows and re-save as UTF-8 without BOM with LF line endings.

Example fix

// before (malformed)
[libdefaults
 default_realm = EXAMPLE.COM

// after
[libdefaults]
 default_realm = EXAMPLE.COM

func validateKrb5Syntax(path string) error {
    data, err := os.ReadFile(path)
    if err != nil {
        return err
    }
    text := strings.TrimSpace(string(bytes.TrimPrefix(data, []byte{0xEF, 0xBB, 0xBF})))
    if !strings.Contains(text, "[libdefaults]") {
        return fmt.Errorf("%s: missing required [libdefaults] section", path)
    }
    if _, err := krb5config.Load(path); err != nil {
        return fmt.Errorf("%s fails krb5 parsing: %w", path, err)
    }
    return nil
}

func isParseableKrb5(path string) bool {
    _, err := krb5config.Load(path)
    return err == nil
}

if err := cfg.Finalize(user, pass); err != nil {
    if strings.Contains(err.Error(), "load Kerberos config") {
        return fmt.Errorf("krb5.conf syntax error; validate with kinit or restore a known-good copy: %w", err)
    }
    return err
}

When it happens

Trigger: finalize loading a syntactically invalid krb5.conf (e.g. missing [libdefaults] section braces, stray characters, unknown encoding) during newKerberosAuthProvider or in tests exercising finalize.

Common situations: Hand-edited krb5.conf with a syntax error, a Windows-edited file with BOM or CRLF issues, or a truncated file produced by a config management tool.

Related errors

• invalid Kerberos config path: %w
• Kerberos requires krb5.conf or Windows SSPI
• ZooKeeper Kerberos SASL requires Hive Kerberos credentials
• ZooKeeper server list is empty
• ZooKeeper Kerberos SASL requires Hive Kerberos credentials

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/06fecc6726d61fc7. Report an issue: GitHub.