aeron-io/aeron · error · ArchiveException

Replication does not support challenge/response…

Error message

Replication does not support challenge/response authentication

What it means

ReplicationCredentialsSupplier implements the credentials callback interface but deliberately does not support challenge/response authentication: onChallenge always throws ArchiveException. Aeron archive replication only supports a static encodedCredentials supplied up front; if the source archive demands a challenge, replication cannot satisfy it.

Solutions

1. Reconfigure the source archive's authentication service to accept the static credentials without issuing a challenge (e.g. accept the encoded credentials in onConnectRequest)
2. Supply the exact credentials the source archive expects up front via .sourceCredentials()/replicationCredentials in ReplicationParams so no challenge round-trip occurs
3. If challenge/response is required, implement replication through the regular archive client APIs instead of the replication feature
4. Catch the ArchiveException at replication start and surface a clear configuration error to the operator

Example fix

// before: replication against a challenge-based authenticator
ReplicationParams params = new ReplicationParams()
    .sourceCredentials(encodedCredentials);

// after: source archive authenticator accepts without challenge
public long onConnectRequest(...) { return acceptSession(...); } // no challenge issued
// or use a plain archive client to drive replication when challenges are mandatory

// before replicating, confirm the source archive's authenticator accepts static credentials
if (sourceArchiveRequiresChallenge) {
    throw new ConfigurationException("replication needs a non-challenge authenticator on the source archive");
}

try {
    replicationId = archive.replicate(recordingId, dstRecordingId, srcControlChannel, srcReplicationChannel);
} catch (ArchiveException e) {
    if (e.getMessage().contains("challenge/response")) {
        throw new ConfigurationException("source archive demands challenge/response; replication unsupported — reconfigure authenticator");
    }
    throw e;
}

When it happens

Trigger: onChallenge (part of the AuthenticatedSessionProxy callback flow) is invoked when the source archive's authentication service responds to the connect credentials with a challenge rather than accepting them immediately — i.e. the remote archive is configured with an authenticator that issues challenges (e.g. SessionProxyChallenge). Any replication started against such an archive will throw this.

Common situations: Replicating from an archive whose authenticator requires challenge/response (e.g. a challenge-based AcceptanceAuthenticator) while the replicating side supplies only static encodedCredentials via ReplicationParams; copying a client configuration that worked for normal archive clients (which do support challenge/response) to the replication API, which does not.

Understand the failure class

Background: UnsupportedOperationException and "is not supported" errors: when a library deliberately refuses a call — this error's family across 30 libraries.

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• authenticator cannot be null
• failed to list remote recording descriptor
• failed to fetch remote recording descriptor
• failed to send recording position request
• cannot live merge without active source recording

AI-assisted analysis of aeron-io/aeron@6d60124e15 (2026-09-12). Data as JSON: /api/errors/975acdd340ae5d8f. Report an issue: GitHub.

Appendix: source

Thrown at aeron-archive/src/main/java/io/aeron/archive/ReplicationCredentialsSupplier.java:37

import io.aeron.security.CredentialsSupplier;

class ReplicationCredentialsSupplier implements CredentialsSupplier
{
    private final byte[] encodedCredentials;

    ReplicationCredentialsSupplier(final byte[] encodedCredentials)
    {
        this.encodedCredentials = encodedCredentials;
    }

    public byte[] encodedCredentials()
    {
        return encodedCredentials;
    }

    public byte[] onChallenge(final byte[] encodedChallenge)
    {
        throw new ArchiveException("Replication does not support challenge/response authentication");
    }
}

View on GitHub (pinned to 6d60124e15)