NationalSecurityAgency/ghidra · error · SQLException

No registered authenticator

Error message

No registered authenticator

What it means

Thrown by BSimPostgresDBConnectionManager when the connection type is SSL_Password_Authentication but ClientUtil.getClientAuthenticator() returns null. SSL password authentication routes credential prompting through a registered ClientAuthenticator (normally installed by the Ghidra GUI layer); if none is registered, the connection cannot solicit credentials and throws SQLException.

Source

Thrown at Ghidra/Features/BSim/src/main/java/ghidra/features/bsim/query/BSimPostgresDBConnectionManager.java:336

					connectionType = ConnectionType.Unencrypted_No_Authentication;
					bds.removeConnectionProperty("sslmode");
					bds.removeConnectionProperty("sslfactory");
				}
				else {
					throw e;
				}
			}
			finally {
				Msg.debug(this, serverInfo + " getConnection: active=" + bds.getNumActive() +
					" idle=" + bds.getNumIdle());
			}

			while (true) {
				ClientAuthenticator clientAuthenticator = null;
				if (connectionType == ConnectionType.SSL_Password_Authentication) {
					clientAuthenticator = ClientUtil.getClientAuthenticator();
					if (clientAuthenticator == null) { // Make sure authenticator is registered
						throw new SQLException("No registered authenticator");
					}
					NameCallback nameCb = new NameCallback("User ID:", bds.getUsername());
					boolean allowUserIDEntry = true;
					if (!serverInfo.hasDefaultLogin()) {
						nameCb.setName(bds.getUsername());
						allowUserIDEntry = false;
					}
					PasswordCallback passCb = new PasswordCallback(" ", false); // force use of default prompting
					try {
						if (!clientAuthenticator.processPasswordCallbacks(
							"BSim Database Authentication", "BSim DB Server", serverInfo.toString(),
							allowUserIDEntry, nameCb, passCb, null, null, loginError)) {
							throw new CancelledException();
						}
						bds.setPassword(new String(passCb.getPassword()));
						// User may have specified new username, or this may return NULL
						if (serverInfo.hasDefaultLogin()) {
							bds.setUsername(nameCb.getName());

View on GitHub (pinned to d5f144c24d)

Solutions

1. Register a ClientAuthenticator via ClientUtil before connecting, e.g. ClientUtil.setClientAuthenticator(new YourAuthenticator()).
2. If running under the Ghidra GUI, ensure the application is properly initialized so the default authenticator is installed.
3. For headless use, implement a ClientAuthenticator that supplies credentials programmatically.

Example fix

// before (no authenticator registered for SSL password auth)
Connection c = dbConnectionManager.getConnection(sslServerInfo); // SQLException
// after (register an authenticator first)
ClientUtil.setClientAuthenticator(myHeadlessAuthenticator);
Connection c = dbConnectionManager.getConnection(sslServerInfo);

if (connectionType == ConnectionType.SSL_Password_Authentication && ClientUtil.getClientAuthenticator() == null) {
    throw new IllegalStateException("No ClientAuthenticator registered; register one before SSL password auth");
}

try {
    Connection c = dbConnectionManager.getConnection(sslServerInfo);
} catch (SQLException e) {
    if ("No registered authenticator".equals(e.getMessage())) {
        ClientUtil.setClientAuthenticator(myAuthenticator);
        Connection c = dbConnectionManager.getConnection(sslServerInfo);
    } else {
        throw e;
    }
}

When it happens

Trigger: Opening an SSL password-authenticated BSim PostgreSQL connection in a context where no ClientAuthenticator has been registered with ClientUtil (e.g., a headless or non-Ghidra-framework caller).

Common situations: Running BSim queries from a headless script or test harness that did not initialize the Ghidra client authentication layer; integrating BSim into a custom application without registering an authenticator.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• PKI authentication requested, but certificate authority file
• {} is not a valid certification authority
• File {} does not appear to be a certificate
• Distinguished name option (--dn) required for {}
• Error copying original connection file

AI-assisted analysis of NationalSecurityAgency/ghidra@d5f144c24d (2026-08-14). Data as JSON: /api/errors/67f097d6748e59b6. Report an issue: GitHub.