NationalSecurityAgency/ghidra · error · IllegalArgumentException

Unknown authentication method: {} : options are trust, passw

Error message

Unknown authentication method: {} : options are trust, password or pki

What it means

Thrown in the AUTH_OPTION case when the --auth value is not one of 'trust', 'none', 'password', or 'pki'. These strings map to the internal AUTHENTICATION_NONE / AUTHENTICATION_PASSWORD / AUTHENTICATION_PKI constants used for both host and local connection authentication.

Source

Thrown at Ghidra/Features/BSim/src/main/java/ghidra/features/bsim/query/BSimControlLaunchable.java:327

					certAuthorityFile = new File(value);
					break;
				case AUTH_OPTION:
					authConfigPresent = true;
					String type = value;
					if (type.equals("pki")) {
						hostAuthentication = AUTHENTICATION_PKI;
						localAuthentication = AUTHENTICATION_PKI;
					}
					else if (type.equals("password")) {
						hostAuthentication = AUTHENTICATION_PASSWORD;
						localAuthentication = AUTHENTICATION_PASSWORD;
					}
					else if (type.equals("trust") || type.equals("none")) {
						hostAuthentication = AUTHENTICATION_NONE;
						localAuthentication = AUTHENTICATION_NONE;
					}
					else {
						throw new IllegalArgumentException("Unknown authentication method: " +
							type + " : options are trust, password or pki");
					}
					break;
				case DN_OPTION:
					distinguishedName = value;
					validateDistinguishedName();
					break;
				case NO_LOCAL_AUTH_OPTION:
					sawNoLocalAuth = true;
					break;
				case FORCE_OPTION:
					forceShutdown = true;
					break;
				default:
					throw new AssertionError("Missing option handling: " + option);
			}
		}

View on GitHub (pinned to d5f144c24d)

Solutions

1. Use one of: trust, none (alias of trust), password, or pki.
2. Double-check spelling and case — matching is exact via String.equals.
3. Re-read the error message which lists the valid options.

Example fix

// before
bsim control configure host --auth certificate
// after
bsim control configure host --auth pki

// Constrain --auth to the accepted methods before launching.
Set<String> auths = Set.of("trust", "none", "password", "pki");
if (!auths.contains(authValue)) {
    System.err.println("Invalid --auth: " + authValue + ". Choose: trust, password, pki");
    return;
}

try {
    launchable.readOptions(command, params, discard);
} catch (IllegalArgumentException e) {
    if (e.getMessage().startsWith("Unknown authentication method:")) {
        System.err.println("Use --auth trust|password|pki (none == trust).");
    }
    throw e;
}

When it happens

Trigger: Passing `--auth otp`, `--auth certificate`, or any value not matching the four accepted strings (line 327).

Common situations: Typo in the method name, expecting modern SSO/OAuth-style methods, or using a value copied from unrelated software docs.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Unknown command: {}
• Unsupported command: {}
• Unsupported option use: {}
• Unexpected argument: {}
• Unsupported option specification: {}=

AI-assisted analysis of NationalSecurityAgency/ghidra@d5f144c24d (2026-08-14). Data as JSON: /api/errors/cf893b2e8b4afef5. Report an issue: GitHub.