{"record":{"id":"33f6965d486120e9","repo":"vitessio/vitess","slug":"w-s-33f696","errorCode":null,"errorMessage":"%w %s","messagePattern":"%w %s","errorType":"exception","errorClass":"ErrUnregisteredAuthenticationImpl","httpStatus":null,"severity":"error","filePath":"go/vt/vtadmin/rbac/config.go","lineNumber":141,"sourceCode":"\n\tc.cfg = byResource\n\tc.authorizer = &Authorizer{\n\t\tpolicies: c.cfg,\n\t}\n\n\t// reify the authenticator\n\tswitch {\n\tcase strings.HasSuffix(c.Authenticator, \".so\"):\n\t\tauthn, err := loadAuthenticatorPlugin(c.Authenticator)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\n\t\tc.authenticator = authn\n\tcase c.Authenticator != \"\":\n\t\tfactory, ok := authenticators[c.Authenticator]\n\t\tif !ok {\n\t\t\treturn fmt.Errorf(\"%w %s\", ErrUnregisteredAuthenticationImpl, c.Authenticator)\n\t\t}\n\n\t\tc.authenticator = factory()\n\tdefault:\n\t\tlog.Info(\"[rbac]: no authenticator implementation specified\")\n\t\tc.authenticator = nil // Technically a no-op, but being super explicit about it.\n\t}\n\n\tc.reified = true\n\treturn nil\n}\n\n// GetAuthenticator returns the Authenticator implementation specified by the\n// config. It returns nil if the Authenticator string field is the empty string,\n// or if a call to Reify has not been made.\nfunc (c *Config) GetAuthenticator() Authenticator {\n\treturn c.authenticator\n}","sourceCodeStart":123,"sourceCodeEnd":159,"githubUrl":"https://github.com/vitessio/vitess/blob/01a25a7d176f94613b8d59d799f438380a8760e4/go/vt/vtadmin/rbac/config.go#L123-L159","documentation":"vtadmin's RBAC config `Reify` fails when the configured `authenticator` name does not match any implementation registered in the `authenticators` map. The error wraps `ErrUnregisteredAuthenticationImpl` and appends the unknown authenticator name. This is a fail-fast guard so vtadmin never starts with a silently absent authorizer backend.","triggerScenarios":"Calling rbac.Config.Reify when Config.Authenticator is set to a non-empty string that is not a key in the authenticators registry (e.g. a typo like 'grpc' vs 'grpcclient', or a custom authenticator whose init() registration was never imported).","commonSituations":"Typoed authenticator name in vtadmin config; blank or forgotten import of the package that registers the authenticator via init(); renaming/moving an authenticator implementation across Vitess versions while the config file still references the old name.","solutions":["Check the authenticator name in the vtadmin config against the keys registered in go/vt/vtadmin/rbac/authenticator (grpcclient, etcd, file, etc.) and fix the spelling.","Ensure the package containing the authenticator's init() registration is imported (directly or via a supported-imports file) in the vtadmin binary being run.","If no authenticator is wanted, remove the authenticator setting so Reify takes the default branch and logs 'no authenticator implementation specified'."],"exampleFix":"// before (config)\n{\"authenticator\": \"grpc\"}\n// after\n{\"authenticator\": \"grpcclient\"}","handlingStrategy":"validation","validationCode":"// Go: check registration before calling Reify\nif cfg.Authenticator != \"\" {\n    if _, ok := rbac.GetRegisteredAuthenticators()[cfg.Authenticator]; !ok {\n        return fmt.Errorf(\"authenticator %q is not registered; check name and imports\", cfg.Authenticator)\n    }\n}","typeGuard":null,"tryCatchPattern":"err := cfg.Reify(); if err != nil && errors.Is(err, rbac.ErrUnregisteredAuthenticationImpl) { /* fix config name or register impl */ }","preventionTips":["Keep authenticator names in a shared constant or enum instead of raw strings in config files.","Ensure the side-effect import of the authenticator registration package is present in the vtadmin binary.","Validate the vtadmin config at deploy time before starting the server."],"tags":["rbac","authentication","configuration","vtadmin"],"backgroundTag":"unregistered-authenticator-implementation","analyzedSha":"01a25a7d176f94613b8d59d799f438380a8760e4","analyzedAt":"2026-09-01T17:28:30.605Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}