{"record":{"id":"274058babba7e581","repo":"t8y2/dbx","slug":"authenticate-to-zookeeper-w-274058","errorCode":null,"errorMessage":"authenticate to ZooKeeper: %w","messagePattern":"authenticate to ZooKeeper: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/hive-go/discovery.go","lineNumber":117,"sourceCode":"\t}\n\ttimeout := discovery.timeout\n\tif timeout <= 0 {\n\t\ttimeout = defaultConnectTimeout\n\t}\n\tconnection, events, err := discovery.dialer(addresses, timeout)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"connect to ZooKeeper: %w\", err)\n\t}\n\tdefer connection.Close()\n\tif err := waitForZooKeeperSession(ctx, events, timeout); err != nil {\n\t\treturn nil, err\n\t}\n\tif discovery.authScheme != \"\" || discovery.auth != \"\" {\n\t\tif discovery.authScheme == \"\" || discovery.auth == \"\" {\n\t\t\treturn nil, errors.New(\"ZooKeeper auth scheme and credentials must be configured together\")\n\t\t}\n\t\tif err := connection.AddAuth(discovery.authScheme, []byte(discovery.auth)); err != nil {\n\t\t\treturn nil, fmt.Errorf(\"authenticate to ZooKeeper: %w\", err)\n\t\t}\n\t}\n\tresolved := make([]endpoint, 0)\n\tvar listedPath string\n\tvar nodeFailures []string\n\tfor _, path := range discovery.paths() {\n\t\tchildren, _, childrenErr := connection.Children(path)\n\t\tif errors.Is(childrenErr, zk.ErrNoNode) {\n\t\t\tcontinue\n\t\t}\n\t\tif childrenErr != nil {\n\t\t\treturn nil, fmt.Errorf(\"list ZooKeeper namespace %s: %w\", path, childrenErr)\n\t\t}\n\t\tlistedPath = path\n\t\tfor _, child := range children {\n\t\t\tdata, _, dataErr := connection.Get(path + \"/\" + child)\n\t\t\tif dataErr != nil {\n\t\t\t\tif errors.Is(dataErr, zk.ErrNoNode) {","sourceCodeStart":99,"sourceCodeEnd":135,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/hive-go/discovery.go#L99-L135","documentation":"This error wraps connection.AddAuth failures when authenticating the ZooKeeper session (discovery.go:117). It fires when an auth scheme/credentials are configured (e.g. digest SASL) and AddAuth rejects the scheme or credentials. Misconfiguration where only one of scheme or credentials is set produces a distinct error before this point.","triggerScenarios":"discovery.authScheme or discovery.auth is non-empty, both are set (pair validated), and connection.AddAuth(scheme, []byte(auth)) returns an error: invalid scheme, malformed credentials, or session state issues.","commonSituations":"Digest ACL-protected HiveServer2 znodes where the digest secret is wrong or misformatted (user:password); ZooKeeper SASL configuration copied incompletely from JDBC settings; scheme typo (e.g. 'digest' misspelled).","solutions":["Verify the auth scheme (e.g. digest) and credentials are both correct and formatted as expected (user:password for digest).","Confirm the credentials match the ACLs on the HiveServer2 znodes.","Check the ZooKeeper server logs for the rejection reason.","Remove the auth parameters if the znodes do not require authentication."],"exampleFix":"// before\nparams[\"zookeeperauth\"] = \"digest\"\nparams[\"zookeeperauthdata\"] = \"svcuser\" // missing password part\n// after\nparams[\"zookeeperauth\"] = \"digest\"\nparams[\"zookeeperauthdata\"] = \"svcuser:svcsecret\"","handlingStrategy":"validation","validationCode":"scheme, auth := params[\"zookeeperauth\"], params[\"zookeeperauthdata\"]\nif (scheme != \"\") != (auth != \"\") {\n    return errors.New(\"zookeeper auth scheme and credentials must both be set\")\n}\nif scheme == \"digest\" && !strings.Contains(auth, \":\") {\n    return errors.New(\"digest auth must be user:password\")\n}\n","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always set scheme and credentials together, never one alone.","Use the exact digest string (user:password) matching the znode ACLs.","Keep zk auth configuration in sync with your ZooKeeper ACL management.","Test discovery against ACL-protected znodes in staging before production."],"tags":["zookeeper","authentication","go"],"backgroundTag":"zookeeper-auth-failed","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}