{"record":{"id":"0bcdbf3c04052151","repo":"t8y2/dbx","slug":"continue-zookeeper-digest-md5-negotiation-at-round","errorCode":null,"errorMessage":"continue ZooKeeper DIGEST-MD5 negotiation at round %d: %w","messagePattern":"continue ZooKeeper DIGEST-MD5 negotiation at round (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/zookeeper/sasl.go","lineNumber":107,"sourceCode":"\n\ttoken, err := saslClient.Start()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"start ZooKeeper DIGEST-MD5 negotiation: %w\", err)\n\t}\n\tfor round := 0; round < zooKeeperSASLMaxRounds; round++ {\n\t\tchallenge, err := zooKeeperSASLRound(connection, zooKeeperSASLXIDBase+int32(round), token)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"ZooKeeper SASL round %d: %w\", round+1, err)\n\t\t}\n\t\tif saslClient.Complete() {\n\t\t\tif len(challenge) != 0 {\n\t\t\t\treturn errors.New(\"ZooKeeper sent an unexpected token after DIGEST-MD5 completion\")\n\t\t\t}\n\t\t\treturn nil\n\t\t}\n\t\ttoken, err = saslClient.Step(challenge)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"continue ZooKeeper DIGEST-MD5 negotiation at round %d: %w\", round+1, err)\n\t\t}\n\t\tif saslClient.Complete() {\n\t\t\tif len(token) != 0 {\n\t\t\t\treturn errors.New(\"ZooKeeper DIGEST-MD5 completed with an unexpected client token\")\n\t\t\t}\n\t\t\treturn nil\n\t\t}\n\t}\n\treturn fmt.Errorf(\"ZooKeeper DIGEST-MD5 negotiation exceeded %d rounds\", zooKeeperSASLMaxRounds)\n}\n\nfunc zooKeeperSASLRound(connection net.Conn, xid int32, token []byte) ([]byte, error) {\n\tpayload := make([]byte, 12+len(token))\n\tbinary.BigEndian.PutUint32(payload[0:4], uint32(xid))\n\tbinary.BigEndian.PutUint32(payload[4:8], uint32(zooKeeperSASLOpcode))\n\tbinary.BigEndian.PutUint32(payload[8:12], uint32(len(token)))\n\tcopy(payload[12:], token)\n\tif err := writeZooKeeperFrame(connection, payload); err != nil {","sourceCodeStart":89,"sourceCodeEnd":125,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/zookeeper/sasl.go#L89-L125","documentation":"After receiving a challenge, the client calls saslClient.Step(challenge) to compute the next response. If Step rejects the challenge (malformed rspauth, protocol violation, wrong credentials), the error is wrapped as \"continue ZooKeeper DIGEST-MD5 negotiation at round %d: %w\". This is a client-side cryptographic/protocol rejection, not a network error.","triggerScenarios":"negotiateSASLDigest's loop calls saslClient.Step(challenge) at round N and Step returns an error, typically because the server's challenge is not a valid DIGEST-MD5 response for the given credentials.","commonSituations":"Wrong username/password (the server's rspauth check fails), server using a different qop/realm configuration than the client expects, or an incompatible SASL implementation on one side.","solutions":["Re-check the digest username/password — bad credentials most commonly make Step fail.","Compare qop/realm/cipher settings negotiated with the server's SASL configuration.","Look at the wrapped inner error for the precise Step failure reason.","Ensure both client and server use standard DIGEST-MD5 semantics; upgrade the SASL client library if it deviates."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Verify credentials before starting; bad secrets are the most common Step() failure.\nif creds.User == \"\" || creds.Password == \"\" { return errors.New(\"empty SASL credentials\") }","typeGuard":null,"tryCatchPattern":"err := negotiateSASLDigest(conn, creds)\nif err != nil && strings.Contains(err.Error(), \"continue ZooKeeper DIGEST-MD5 negotiation\") {\n\treturn fmt.Errorf(\"check DIGEST-MD5 credentials/qop settings: %w\", err)\n}","preventionTips":["Double-check digest username/password before enabling SASL.","Match qop/realm/cipher settings with the server's JAAS configuration.","Test the same credentials with zkCli.sh digest auth to validate them independently."],"tags":["sasl","authentication","digest-md5","zookeeper"],"backgroundTag":"sasl-step-invalid-challenge","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}