t8y2/dbx · error

load Kerberos credential cache %s: %w

Error message

load Kerberos credential cache %s: %w

What it means

In newKerberosClient, when the credential mode is ccache, credentials.LoadCCache reads the Kerberos credential cache file at config.ccachePath. Failure to read/parse it (missing file, unreadable permissions, corrupt format) is wrapped with the cache path.

Source

Thrown at agents/drivers/cassandra-go/kerberos.go:291

	clientName.NameString = append([]string(nil), clientName.NameString...)
	authenticator := &kerberosAuthenticator{
		domain:          strings.Clone(client.Credentials.Domain()),
		clientName:      clientName,
		ticket:          ticket,
		sessionKey:      sessionKey,
		authorizationID: config.authorizationID,
	}
	client.Destroy()
	return authenticator, nil
}

func newKerberosClient(config kerberosConfig, krbConfig *krb5config.Config) (*krb5client.Client, error) {
	settings := []func(*krb5client.Settings){krb5client.DisablePAFXFAST(config.disablePAFXFAST)}
	switch config.credentialMode {
	case kerberosCredentialCCache:
		cache, err := credentials.LoadCCache(config.ccachePath)
		if err != nil {
			return nil, fmt.Errorf("load Kerberos credential cache %s: %w", config.ccachePath, err)
		}
		client, err := krb5client.NewFromCCache(cache, krbConfig, settings...)
		if err != nil {
			return nil, fmt.Errorf("create Kerberos client from credential cache: %w", err)
		}
		return client, nil
	case kerberosCredentialKeytab:
		loadedKeytab, err := keytab.Load(config.keytabPath)
		if err != nil {
			return nil, fmt.Errorf("load Kerberos keytab %s: %w", config.keytabPath, err)
		}
		return krb5client.NewWithKeytab(
			config.credentialUser,
			config.credentialRealm,
			loadedKeytab,
			krbConfig,
			settings...,
		), nil

View on GitHub (pinned to c0390bff16)

Solutions

1. Run `kinit <principal>` as the same user the app runs as; confirm the path in the error exists (`klist -c <path>`).
2. Fix file permissions/ownership of the ccache file.
3. Point ccachePath (or KRB5CCNAME) at a valid FILE: cache; convert DIR-type caches if the loader rejects them (`kinit` then copy FILE cache).
4. If tickets expired, re-authenticate with kinit.

Example fix

// before: app user has no cache
// shell: KRB5CCNAME unset, no kinit
// after
// kinit -c FILE:/tmp/app-krb5cc cassandra@EXAMPLE.COM
// config: ccachePath: "/tmp/app-krb5cc"

func ensureCCache(path string) error {
	info, err := os.Stat(path)
	if err != nil { return fmt.Errorf("ccache missing at %s: %w", path, err) }
	f, err := os.Open(path)
	if err != nil { return fmt.Errorf("ccache unreadable (permissions?): %w", err) }
	defer f.Close()
	var magic [2]byte
	if _, err := io.ReadFull(f, magic[:]); err != nil || magic[0] != 0x05 {
		return errors.New("not a valid FILE ccache")
	}
	return nil
}

When it happens

Trigger: kerberosCredentialCCache selected (useTicketCache or ccachePath/default /tmp/krb5cc_<uid>) and LoadCCache fails: path does not exist, permissions deny read, or the file is not a valid ccache.

Common situations: No kinit was run so /tmp/krb5cc_1000 was never created; KRB5CCNAME points to a DIR:/cache collection the loader can't read; ccache created as root but app runs as another user; kinit performed in a different container/filesystem.

Related errors

• create Kerberos client from credential cache: %w
• Kerberos credentials are not configured
• Kerberos requires SSPI, credential cache, keytab, or princip
• Kerberos authentication requires a credential cache, keytab,
• Kerberos keytab authentication requires a keytab path

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/5ba7217a61ddf2db. Report an issue: GitHub.