unexpected Cassandra Kerberos authentication challenge

Error message

unexpected Cassandra Kerberos authentication challenge

What it means

Returned by kerberosAuthenticator.Challenge when the Cassandra server sends an additional authentication challenge after the two-step GSSAPI exchange (initial token + security-layer response) already completed. The SASL state machine only expects challenges at steps 0 and 1; a third challenge indicates a protocol violation or server-side negotiation mismatch.

Source

Thrown at agents/drivers/cassandra-go/kerberos.go:340

func (authenticator *kerberosAuthenticator) Challenge(request []byte) ([]byte, gocql.Authenticator, error) {
	switch authenticator.step {
	case 0:
		token, err := authenticator.initialToken()
		if err != nil {
			return nil, nil, err
		}
		authenticator.step = 1
		return token, authenticator, nil
	case 1:
		token, err := authenticator.securityLayerResponse(request)
		if err != nil {
			return nil, nil, err
		}
		authenticator.step = 2
		return token, authenticator, nil
	default:
		return nil, nil, fmt.Errorf("unexpected Cassandra Kerberos authentication challenge")
	}
}

func (authenticator *kerberosAuthenticator) Success(_ []byte) error {
	if authenticator.step != 2 {
		return fmt.Errorf("Cassandra reported Kerberos success before SASL negotiation completed")
	}
	return nil
}

func (authenticator *kerberosAuthenticator) initialToken() ([]byte, error) {
	value, err := types.NewAuthenticator(authenticator.domain, authenticator.clientName)
	if err != nil {
		return nil, err
	}
	value.Cksum = types.Checksum{
		CksumType: chksumtype.GSSAPI,
		Checksum:  kerberosAuthenticatorChecksum(),

View on GitHub (pinned to c0390bff16)

Solutions

Confirm the Cassandra cluster's SASL/GSSAPI configuration matches what the agent negotiated (Kerberos URI, QOP settings)
Check server logs for repeated or restarted auth negotiations
Verify the krb5 keytab and principal are correct so negotiation completes in the expected two rounds

Defensive patterns

Strategy: fallback

When it happens

Trigger: Thrown at agents/drivers/cassandra-go/kerberos.go:340 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/9edf4c8735182635. Report an issue: GitHub.