alibaba/canal · error · ServiceException

something goes wrong when doing authentication: {}

Error message

something goes wrong when doing authentication: {}

What it means

Thrown when the auth ACK is correctly typed but ackBody.getCode() > 0, i.e. the server reported an authentication error with a descriptive message. The thrown ServiceException appends the server's message.

Source

Thrown at admin/admin-web/src/main/java/com/alibaba/otter/canal/admin/connector/SimpleAdminConnector.java:107

                .setUsername(user != null ? user : "")
                .setPassword(ByteString.copyFromUtf8(newPasswd != null ? newPasswd : ""))
                .setNetReadTimeout(idleTimeout)
                .setNetWriteTimeout(idleTimeout)
                .build();
            writeWithHeader(Packet.newBuilder()
                .setType(PacketType.CLIENTAUTHENTICATION)
                .setBody(ca.toByteString())
                .build()
                .toByteArray());
            //
            Packet ack = Packet.parseFrom(readNextPacket());
            if (ack.getType() != PacketType.ACK) {
                throw new CanalClientException("unexpected packet type when ack is expected");
            }

            Ack ackBody = Ack.parseFrom(ack.getBody());
            if (ackBody.getCode() > 0) {
                throw new ServiceException("something goes wrong when doing authentication: " + ackBody.getMessage());
            }

            connected = true;
        } catch (IOException | NoSuchAlgorithmException e) {
            throw new ServiceException(e);
        }
    }

    @Override
    public void disconnect() throws ServiceException {
        if (!connected) {
            return;
        }

        connected = false;
        if (readableChannel != null) {
            quietlyClose(readableChannel);
            readableChannel = null;

View on GitHub (pinned to 87be50e876)

Solutions

1. Set the same canal.adminUser/canal.adminPasswd on both admin-web and canal-server.
2. Read the appended ackBody.getMessage() text — it carries the exact server-side reason.
3. Regenerate the password using the documented scramble/encoding step (SecurityUtil.scramble411).
4. Verify the server's user list config includes this admin user.

try {
    connector.connect();
} catch (ServiceException e) {
    if (e.getMessage().contains("doing authentication")) {
        // e.getMessage() includes server-side reason; fix credentials
    }
    throw e;
}

When it happens

Trigger: CLIENTAUTHENTICATION completed the round-trip and the server returned an ACK with a positive (error) code — wrong username, wrong/scrambled password, or server refusing the client.

Common situations: Wrong admin password (scramble411 mismatch); user not registered on the server; password hash seed handling differs between versions; server auth disabled/misconfigured.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• unexpected packet type when ack is expected
• auth : {} is failed
• canal.adminPasswd is empty , pls check https://github.com/al
• unsupported version at this client.
• expect handshake but found other type.

AI-assisted analysis of alibaba/canal@87be50e876 (2026-08-14). Data as JSON: /api/errors/9740bb96889192c2. Report an issue: GitHub.