{"record":{"id":"1ba3807720092406","repo":"apache/hadoop","slug":"unknown-unsupported-authentication-mechanism","errorCode":null,"errorMessage":"Unknown/unsupported authentication mechanism; \"{}\"","messagePattern":"Unknown/unsupported authentication mechanism; \"(.+?)\"","errorType":"exception","errorClass":"ServiceStateException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-registry/src/main/java/org/apache/hadoop/registry/client/impl/zk/RegistrySecurity.java","lineNumber":219,"sourceCode":"    super.serviceInit(conf);\n    String auth = conf.getTrimmed(KEY_REGISTRY_CLIENT_AUTH,\n        REGISTRY_CLIENT_AUTH_ANONYMOUS);\n\n    switch (auth) {\n    case REGISTRY_CLIENT_AUTH_KERBEROS:\n      access = AccessPolicy.sasl;\n      break;\n    case REGISTRY_CLIENT_AUTH_DIGEST:\n      access = AccessPolicy.digest;\n      break;\n    case REGISTRY_CLIENT_AUTH_ANONYMOUS:\n      access = AccessPolicy.anon;\n      break;\n    case REGISTRY_CLIENT_AUTH_SIMPLE:\n      access = AccessPolicy.simple;\n      break;\n    default:\n      throw new ServiceStateException(E_UNKNOWN_AUTHENTICATION_MECHANISM\n                                      + \"\\\"\" + auth + \"\\\"\");\n    }\n    initSecurity();\n  }\n\n  /**\n   * Init security.\n   *\n   * After this operation, the {@link #systemACLs} list is valid.\n   * @throws IOException\n   */\n  private void initSecurity() throws IOException {\n\n    secureRegistry =\n        getConfig().getBoolean(KEY_REGISTRY_SECURE, DEFAULT_REGISTRY_SECURE);\n    systemACLs.clear();\n    if (secureRegistry) {\n      addSystemACL(ALL_READ_ACCESS);","sourceCodeStart":201,"sourceCodeEnd":237,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-registry/src/main/java/org/apache/hadoop/registry/client/impl/zk/RegistrySecurity.java#L201-L237","documentation":"RegistrySecurity maps the hadoop.registry.client.auth configuration to an internal AccessPolicy. Only four spellings are accepted: '' (anonymous), 'simple', 'kerberos' (SASL) and 'digest'. Any other value falls to the default branch of the switch and throws ServiceStateException('Unknown/unsupported authentication mechanism; \"<value>\"') with the offending value quoted so the bad setting is obvious.","triggerScenarios":"hadoop.registry.client.auth set to an unrecognized string such as 'sasl' (the spelling many other ZK clients use), 'none', 'DIGEST' (case-sensitive), 'anonymous', or a typo.","commonSituations":"Hand-editing registry client configuration; porting settings from other ZooKeeper clients where 'sasl' is the conventional value; case mismatches and typos in XML config files.","solutions":["Set hadoop.registry.client.auth to one of '', 'simple', 'kerberos', 'digest'.","Prefer RegistryOperationsFactory.createAnonymousInstance/createKerberosInstance/createAuthenticatedInstance, which set this key correctly for you.","Add a startup validation of the value against the four accepted spellings so the mistake fails fast with a clear message."],"exampleFix":"// before\nconf.set(\"hadoop.registry.client.auth\", \"sasl\"); // unsupported spelling -> ServiceStateException\n\n// after: accepted values are \"\", \"simple\", \"kerberos\", \"digest\" — or use the factory\nRegistryOperations ops = RegistryOperationsFactory.createKerberosInstance(conf, principal, keytab);","handlingStrategy":"validation","validationCode":"Set<String> accepted = new HashSet<>(Arrays.asList(\"\", \"simple\", \"kerberos\", \"digest\"));\nString auth = conf.get(\"hadoop.registry.client.auth\", \"\");\nif (!accepted.contains(auth)) {\n  throw new IllegalArgumentException(\n      \"hadoop.registry.client.auth must be one of '', 'simple', 'kerberos', 'digest': got '\" + auth + \"'\");\n}\nRegistryOperations ops = RegistryOperationsFactory.createAnonymousInstance(conf); // or the matching factory method","typeGuard":null,"tryCatchPattern":"try {\n  RegistryOperations ops = RegistryOperationsFactory.createKerberosInstance(conf, principal, keytab);\n} catch (ServiceStateException e) {\n  // message quotes the bad auth value: fix hadoop.registry.client.auth and retry\n}","preventionTips":["Use RegistryOperationsFactory methods instead of setting hadoop.registry.client.auth by hand.","Remember 'sasl' is not a valid Hadoop spelling — Hadoop uses 'kerberos'.","Add the accepted-values check to a config-validation suite so typos fail at deploy time."],"tags":["registry","configuration","authentication","hadoop-registry"],"backgroundTag":"invalid-config-value","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}