{"record":{"id":"1a0c30c89cbef30a","repo":"apache/shardingsphere","slug":"wrong-operation-s-during-authentication-phase","errorCode":null,"errorMessage":"Wrong operation %s during authentication phase","messagePattern":"Wrong operation (.+?) during authentication phase","errorType":"exception","errorClass":"FirebirdProtocolException","httpStatus":null,"severity":"error","filePath":"proxy/frontend/dialect/firebird/src/main/java/org/apache/shardingsphere/proxy/frontend/firebird/authentication/FirebirdAuthenticationEngine.java","lineNumber":105,"sourceCode":"        FirebirdBatchRegistry.getInstance().registerConnection(connectionId);\n        return connectionId;\n    }\n    \n    @Override\n    public AuthenticationResult authenticate(final ChannelHandlerContext context, final PacketPayload payload) {\n        payload.getByteBuf().resetReaderIndex();\n        AuthorityRule rule = ProxyContext.getInstance().getContextManager().getMetaDataContexts().getMetaData().getGlobalRuleMetaData().getSingleRule(AuthorityRule.class);\n        FirebirdPacketPayload fdbPacketPayload = (FirebirdPacketPayload) payload;\n        FirebirdCommandPacketType type = FirebirdCommandPacketType.valueOf(fdbPacketPayload.readInt4());\n        switch (type) {\n            case CONNECT:\n                return processConnect(context, fdbPacketPayload, rule);\n            case ATTACH:\n                return processAttach(context, fdbPacketPayload, rule);\n            case CONT_AUTH:\n                // TODO implement CONT_AUTH\n            default:\n                throw new FirebirdProtocolException(\"Wrong operation %s during authentication phase\", type.name());\n        }\n    }\n    \n    private AuthenticationResult processAttach(final ChannelHandlerContext context, final FirebirdPacketPayload payload, final AuthorityRule rule) {\n        FirebirdAttachPacket attachPacket = new FirebirdAttachPacket(payload);\n        context.channel().attr(CommonConstants.CHARSET_ATTRIBUTE_KEY).set(parseAttachCharset(attachPacket.getEncoding()));\n        login(currentAuthResult.getDatabase(), currentAuthResult.getUsername(), attachPacket, rule);\n        context.writeAndFlush(new FirebirdGenericResponsePacket());\n        return AuthenticationResultBuilder.finished(currentAuthResult.getUsername(), \"\", currentAuthResult.getDatabase(), currentAuthResult.getConnectionAttributes());\n    }\n    \n    private Charset parseAttachCharset(final String encoding) {\n        if (null == encoding) {\n            return FirebirdCharacterSets.findCharacterSet(\"NONE\");\n        }\n        try {\n            return FirebirdCharacterSets.findCharacterSet(encoding);\n        } catch (final IllegalArgumentException ex) {","sourceCodeStart":87,"sourceCodeEnd":123,"githubUrl":"https://github.com/apache/shardingsphere/blob/e952770a215630a3659c75d64369168cd3e26b82/proxy/frontend/dialect/firebird/src/main/java/org/apache/shardingsphere/proxy/frontend/firebird/authentication/FirebirdAuthenticationEngine.java#L87-L123","documentation":"Thrown by the Firebird authentication engine when the first int4 of an authentication-phase packet does not map to a supported operation. Only CONNECT, ATTACH (and the unimplemented CONT_AUTH, which falls through) are handled; the default branch throws FirebirdProtocolException('Wrong operation %s during authentication phase', type.name()). It signals that the client and proxy disagree on the Firebird wire protocol state.","triggerScenarios":"FirebirdAuthenticationEngine.authenticate() resets the reader index, casts the payload to FirebirdPacketPayload, calls FirebirdCommandPacketType.valueOf(payload.readInt4()) and switches on it; any enum constant other than CONNECT/ATTACH (or CONT_AUTH hitting the TODO fallthrough) reaches the default branch and throws.","commonSituations":"a non-Firebird or wrong-wire-version client connects to the Firebird proxy port; a client sends a CONT_AUTH (continued authentication / SASL) op code which is not yet implemented; a hand-written client sends packets out of order; proxy version supports a smaller op set than the client's Firebird wire protocol version.","solutions":["Connect with a real Firebird client library (e.g. Jaybird) at a wire-protocol version the proxy supports, instead of a custom or mismatched client.","If the client uses multi-round authentication (op_resume/CONT_AUTH), disable plugin auth or use classic user/password authentication until CONT_AUTH is implemented.","Check the Firebird wire protocol version negotiated in CONNECT and align client and proxy to a common version (e.g. PROTOCOL_VERSION13).","Capture the packet bytes and confirm the first int4 is an actual op constant; if it is garbage, a connection-length or framing bug earlier in the stream is the real cause."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"// Client side: treat as fatal protocol mismatch, reconnect with a supported auth mode\ncatch (GSException e) {\n    if (e.getMessage().contains(\"Wrong operation\")) {\n        reconnectWithoutPluginAuth(); // use classic user/password, correct wire version\n    }\n}","preventionTips":["Use a maintained Firebird driver (Jaybird) rather than custom wire code.","Avoid multi-round (SASL/CONT_AUTH) authentication against the proxy.","Pin a Firebird wire protocol version both sides support."],"tags":["firebird","protocol","authentication","wire-protocol"],"backgroundTag":null,"analyzedSha":"e952770a215630a3659c75d64369168cd3e26b82","analyzedAt":"2026-08-14T13:54:53.392Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}