t8y2/dbx · error

start ZooKeeper GSSAPI negotiation: %w

Error message

start ZooKeeper GSSAPI negotiation: %w

What it means

Returned by protocolZooKeeperClient.authenticateSASL when the GSSAPI SASL client's initial Start() call fails, so no initial token could be produced for ZooKeeper SASL negotiation. Root causes are Kerberos-level: no TGT, missing keytab, bad principal or JAAS/krb5 configuration.

Source

Thrown at agents/drivers/hive-go/zookeeper_protocol.go:200

func zooKeeperTimeoutMillis(timeout time.Duration) int32 {
	milliseconds := timeout.Milliseconds()
	if milliseconds < 1 {
		return 1
	}
	if milliseconds > math.MaxInt32 {
		return math.MaxInt32
	}
	return int32(milliseconds)
}

func (client *protocolZooKeeperClient) authenticateSASL(saslClient zooKeeperSASLClient) error {
	if saslClient == nil {
		return errors.New("ZooKeeper SASL client is nil")
	}
	defer saslClient.Dispose()
	token, err := saslClient.Start()
	if err != nil {
		return fmt.Errorf("start ZooKeeper GSSAPI negotiation: %w", err)
	}
	for round := 0; round < zooKeeperMaxSASLRounds; round++ {
		response, requestErr := client.request(zooKeeperOpSASL, func(encoder *zooKeeperEncoder) {
			if token == nil {
				encoder.bytes([]byte{})
				return
			}
			encoder.bytes(token)
		})
		if requestErr != nil {
			return fmt.Errorf("ZooKeeper SASL round %d: %w", round+1, requestErr)
		}
		decoder := newZooKeeperDecoder(response)
		challenge, decodeErr := decoder.bytes()
		if decodeErr != nil {
			return fmt.Errorf("decode ZooKeeper SASL round %d: %w", round+1, decodeErr)
		}
		if saslClient.Complete() {

View on GitHub (pinned to c0390bff16)

Solutions

1. Verify the Kerberos environment: TGT present (klist) or keytab readable and correctly referenced
2. Check JAAS config CassandraJavaClient/Client block and krb5.conf realm settings
3. Confirm the service principal for ZooKeeper exists in the KDC
4. Read the wrapped error — it identifies whether credential acquisition or context creation failed

When it happens

Trigger: Thrown at agents/drivers/hive-go/zookeeper_protocol.go:200 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/b19214905aa49cda. Report an issue: GitHub.