What causes "unsupported Cassandra auth provider class: %s" in t8y2/dbx?

unsupported Cassandra auth provider class: %s

Error message

unsupported Cassandra auth provider class: %s

What it means

applyHOCONAuthentication (config_file.go:180) inspects the `advanced.auth-provider.class` from the Java driver HOCON config and only recognizes PlainTextAuthProvider, DsePlainTextAuthProvider, KerberosAuthProvider, ProgrammaticKerberosAuthProvider, and DseGssApiAuthProvider (case-insensitive simple class name). Any other auth provider class is rejected because the Go driver cannot replicate it. The class comparison uses simpleClassName, so fully qualified names are accepted for supported providers.

Source

Thrown at agents/drivers/cassandra-go/config_file.go:180

	}
	if err := applyHOCONSSL(config, parsed); err != nil {
		return err
	}
	return applyNativeHOCON(config, parsed)
}

func applyHOCONAuthentication(config *cassandraConfig, parsed *hocon.Config) error {
	prefix := javaDriverConfigPrefix + "advanced.auth-provider."
	if value, ok, err := hoconString(parsed, prefix+"class"); err != nil {
		return err
	} else if ok {
		switch strings.ToLower(simpleClassName(value)) {
		case "plaintextauthprovider", "dseplaintextauthprovider":
			config.kerberos.enabled = false
		case "kerberosauthprovider", "programmatickerberosauthprovider", "dsegssapiauthprovider":
			config.kerberos.enabled = true
		default:
			return fmt.Errorf("unsupported Cassandra auth provider class: %s", value)
		}
	}
	if value, ok, err := hoconString(parsed, prefix+"username"); err != nil {
		return err
	} else if ok {
		config.username = value
	}
	if value, ok, err := hoconString(parsed, prefix+"password"); err != nil {
		return err
	} else if ok {
		config.password = value
	}
	if value, ok, err := hoconString(parsed, prefix+"authorization-id"); err != nil {
		return err
	} else if ok {
		config.kerberos.authorizationID = value
	}
	for _, path := range []string{prefix + "sasl-protocol", prefix + "service"} {

View on GitHub (pinned to c0390bff16)

Solutions

Change `advanced.auth-provider.class` to one of: PlainTextAuthProvider, DsePlainTextAuthProvider, KerberosAuthProvider, ProgrammaticKerberosAuthProvider, or DseGssApiAuthProvider.
If you were using plain credentials, switch to PlainTextAuthProvider and set advanced.auth-provider.username/password, or use the native dbx.cassandra username/password keys.
If you were using a custom or Kerberos variant provider, reconfigure via the native `dbx.cassandra.kerberos.*` keys instead.
Fix typos in the class name; the check is on the simple class name and is case-insensitive.

Example fix

// before (application.conf)
datastax-java-driver {
  advanced.auth-provider.class = com.example.CustomAuthProvider
}
// after
datastax-java-driver {
  advanced.auth-provider.class = com.datastax.oss.driver.internal.core.auth.PlainTextAuthProvider
}

Defensive patterns

Strategy: validation

Validate before calling

var supportedAuthProviders = map[string]bool{
    "plaintextauthprovider": true,
    "dseplaintextauthprovider": true,
    "kerberosauthprovider": true,
    "programmatickerberosauthprovider": true,
    "dsegssapiauthprovider": true,
}
func validateAuthProvider(cfg *hocon.Config) error {
    const key = "datastax-java-driver.advanced.auth-provider.class"
    if cfg.Get(key) == nil {
        return nil
    }
    v := cfg.GetString(key)
    simple := v
    if i := strings.LastIndex(simple, "."); i >= 0 {
        simple = simple[i+1:]
    }
    if !supportedAuthProviders[strings.ToLower(simple)] {
        return fmt.Errorf("unsupported auth provider: %s", v)
    }
    return nil
}

Type guard

func isSupportedAuthProvider(class string) bool {
    simple := class[strings.LastIndex(class, ".")+1:]
    switch strings.ToLower(simple) {
    case "plaintextauthprovider", "dseplaintextauthprovider",
        "kerberosauthprovider", "programmatickerberosauthprovider", "dsegssapiauthprovider":
        return true
    }
    return false
}

Try / catch

if err := applyCassandraConfigFile(cfgPath); err != nil {
    if strings.Contains(err.Error(), "unsupported Cassandra auth provider") {
        log.Fatalf("use PlainTextAuthProvider or the Kerberos* providers, or configure dbx.cassandra credentials natively")
    }
    return err
}

Prevention

Only use the five supported provider classes in configs shared with Go clients.
For custom auth, configure credentials via native dbx.cassandra keys instead of the Java-driver section.
Keep one canonical, validated application.conf in version control for Go/JVM fleets.

When it happens

Trigger: A HOCON file sets `datastax-java-driver.advanced.auth-provider.class` to a class other than the five supported ones, e.g. a custom `com.example.MyAuthProvider`, `com.datastax.oss.driver.internal.core.auth.PlainTextAuthProvider` misspelled, or `PropertyBasedAuthProvider`.

Common situations: Copying a Java driver config that used a company-custom auth provider; typos like `PlainTextAuthenticator`; using `DseGssApiAuthProvider` misspelled as `DseGSSAPIAuthProvider` is fine (case-insensitive) but `AuthTableBasedAuthProvider` from older DSE versions is not.

Related errors

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/03834516707bcb93. Report an issue: GitHub.