apache/shardingsphere · error · FirebirdProtocolException

Wrong operation %s during authentication phase

Error message

Wrong operation %s during authentication phase

What it means

Thrown by the Firebird authentication engine when the first int4 of an authentication-phase packet does not map to a supported operation. Only CONNECT, ATTACH (and the unimplemented CONT_AUTH, which falls through) are handled; the default branch throws FirebirdProtocolException('Wrong operation %s during authentication phase', type.name()). It signals that the client and proxy disagree on the Firebird wire protocol state.

Source

Thrown at proxy/frontend/dialect/firebird/src/main/java/org/apache/shardingsphere/proxy/frontend/firebird/authentication/FirebirdAuthenticationEngine.java:105

        FirebirdBatchRegistry.getInstance().registerConnection(connectionId);
        return connectionId;
    }
    
    @Override
    public AuthenticationResult authenticate(final ChannelHandlerContext context, final PacketPayload payload) {
        payload.getByteBuf().resetReaderIndex();
        AuthorityRule rule = ProxyContext.getInstance().getContextManager().getMetaDataContexts().getMetaData().getGlobalRuleMetaData().getSingleRule(AuthorityRule.class);
        FirebirdPacketPayload fdbPacketPayload = (FirebirdPacketPayload) payload;
        FirebirdCommandPacketType type = FirebirdCommandPacketType.valueOf(fdbPacketPayload.readInt4());
        switch (type) {
            case CONNECT:
                return processConnect(context, fdbPacketPayload, rule);
            case ATTACH:
                return processAttach(context, fdbPacketPayload, rule);
            case CONT_AUTH:
                // TODO implement CONT_AUTH
            default:
                throw new FirebirdProtocolException("Wrong operation %s during authentication phase", type.name());
        }
    }
    
    private AuthenticationResult processAttach(final ChannelHandlerContext context, final FirebirdPacketPayload payload, final AuthorityRule rule) {
        FirebirdAttachPacket attachPacket = new FirebirdAttachPacket(payload);
        context.channel().attr(CommonConstants.CHARSET_ATTRIBUTE_KEY).set(parseAttachCharset(attachPacket.getEncoding()));
        login(currentAuthResult.getDatabase(), currentAuthResult.getUsername(), attachPacket, rule);
        context.writeAndFlush(new FirebirdGenericResponsePacket());
        return AuthenticationResultBuilder.finished(currentAuthResult.getUsername(), "", currentAuthResult.getDatabase(), currentAuthResult.getConnectionAttributes());
    }
    
    private Charset parseAttachCharset(final String encoding) {
        if (null == encoding) {
            return FirebirdCharacterSets.findCharacterSet("NONE");
        }
        try {
            return FirebirdCharacterSets.findCharacterSet(encoding);
        } catch (final IllegalArgumentException ex) {

View on GitHub (pinned to e952770a21)

Solutions

1. Connect with a real Firebird client library (e.g. Jaybird) at a wire-protocol version the proxy supports, instead of a custom or mismatched client.
2. If the client uses multi-round authentication (op_resume/CONT_AUTH), disable plugin auth or use classic user/password authentication until CONT_AUTH is implemented.
3. Check the Firebird wire protocol version negotiated in CONNECT and align client and proxy to a common version (e.g. PROTOCOL_VERSION13).
4. Capture the packet bytes and confirm the first int4 is an actual op constant; if it is garbage, a connection-length or framing bug earlier in the stream is the real cause.

// Client side: treat as fatal protocol mismatch, reconnect with a supported auth mode
catch (GSException e) {
    if (e.getMessage().contains("Wrong operation")) {
        reconnectWithoutPluginAuth(); // use classic user/password, correct wire version
    }
}

When it happens

Trigger: FirebirdAuthenticationEngine.authenticate() resets the reader index, casts the payload to FirebirdPacketPayload, calls FirebirdCommandPacketType.valueOf(payload.readInt4()) and switches on it; any enum constant other than CONNECT/ATTACH (or CONT_AUTH hitting the TODO fallthrough) reaches the default branch and throws.

Common situations: a non-Firebird or wrong-wire-version client connects to the Firebird proxy port; a client sends a CONT_AUTH (continued authentication / SASL) op code which is not yet implemented; a hand-written client sends packets out of order; proxy version supports a smaller op set than the client's Firebird wire protocol version.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Can not locate agent jar file by URL `%s`.
• Can not support type `%s`.
• Truncated batch BLOB segment length
• Batch BLOB segment declares %d bytes, but only %d bytes rema
• Unknown blob information request type %d

AI-assisted analysis of apache/shardingsphere@e952770a21 (2026-08-14). Data as JSON: /api/errors/1a0c30c89cbef30a. Report an issue: GitHub.