{"record":{"id":"35a939b0ded93df6","repo":"t8y2/dbx","slug":"zookeeper-session-closed-because-sasl-authenticati-35a939","errorCode":null,"errorMessage":"ZooKeeper session closed because SASL authentication is required","messagePattern":"ZooKeeper session closed because SASL authentication is required","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/hive-go/zookeeper_protocol.go","lineNumber":32,"sourceCode":"\t\"sync\"\n\t\"time\"\n\n\t\"github.com/beltran/gosasl\"\n\t\"github.com/go-zookeeper/zk\"\n)\n\nconst (\n\tzooKeeperProtocolVersion = int32(0)\n\tzooKeeperOpGetData       = int32(4)\n\tzooKeeperOpGetChildren2  = int32(12)\n\tzooKeeperOpClose         = int32(-11)\n\tzooKeeperOpSetAuth       = int32(100)\n\tzooKeeperOpSASL          = int32(102)\n\tzooKeeperMaxFrameSize    = 16 << 20\n\tzooKeeperMaxSASLRounds   = 8\n)\n\nvar errZooKeeperSessionClosedRequiresSASL = errors.New(\"ZooKeeper session closed because SASL authentication is required\")\n\ntype zooKeeperSASLClient interface {\n\tStart() ([]byte, error)\n\tStep([]byte) ([]byte, error)\n\tComplete() bool\n\tDispose()\n}\n\nvar newZooKeeperSASLClient = func(host string, config connectionConfig) (zooKeeperSASLClient, error) {\n\tservice, options := zooKeeperGSSAPIOptions(config)\n\tmechanism, err := gosasl.NewGSSAPIMechanismWithOptions(service, options)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\treturn gosasl.NewSaslClient(host, mechanism), nil\n}\n\nvar dialZooKeeperConnection = func(address string, timeout time.Duration, tlsConfig *tls.Config) (net.Conn, error) {","sourceCodeStart":14,"sourceCodeEnd":50,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/hive-go/zookeeper_protocol.go#L14-L50","documentation":"errZooKeeperSessionClosedRequiresSASL maps ZooKeeper error code -124 (Session closed because client failed to authenticate via SASL). zooKeeperError converts the server's close reason into this sentinel so callers can distinguish 'server requires SASL and auth failed/skipped' from other connection failures.","triggerScenarios":"Connecting to a ZooKeeper ensemble with digest authentication while the server enforces SASL; sending an auth payload the server rejects; code -124 returned during connection/authentication.","commonSituations":"ZooKeeper ensemble has quorum.auth.enableSasl=true with a required provider but the Hive/argo client connects without Kerberos/GSSAPI credentials; mismatched SASL schemes between client and server; misconfigured jaas/zk auth in the ensemble.","solutions":["Enable Kerberos SASL on the client connection path (config.Kerberos.Enabled with valid keytab/principal) so the SASL handshake runs","Verify the ensemble's SASL provider and scheme match what the client negotiates (digest vs sasl)","Check server zoo.cfg and jaas.conf to confirm whether SASL is required or optional","Inspect server logs for the SASL failure reason (missing/invalid token, wrong principal)"],"exampleFix":"// before\nconn, _, err := connectPlainZooKeeper(ctx, servers, timeout) // server requires SASL\n// after\nconfig.Kerberos.Enabled = true\nconfig.Kerberos.Principal = \"hive/_HOST@REALM\"\nconfig.Kerberos.Keytab = \"/etc/security/keytabs/hive.keytab\"\nconn, _, err := connectKerberosZooKeeper(ctx, servers, timeout, tlsConfig, config)","handlingStrategy":"validation","validationCode":"// Go: ensure SASL credentials exist before dialing\nif zkCfg.SASLRequired && !(cfg.Kerberos.Enabled && cfg.Kerberos.Keytab != \"\") {\n    return errors.New(\"ZooKeeper requires SASL; configure Kerberos keytab/principal\")\n}","typeGuard":null,"tryCatchPattern":"_, ch, err := connectZooKeeper(ctx, servers, timeout, tls, cfg)\nif errors.Is(err, errZooKeeperSessionClosedRequiresSASL) {\n    return fmt.Errorf(\"ZooKeeper requires SASL auth: %w\", err) // fix config, no blind retry\n}","preventionTips":["Match ensemble SASL settings (zoo.cfg/jaas.conf) with client Kerberos config","Keep keytabs rotated and readable by the service account","Smoke-test ZooKeeper auth with zkCli using the same principal before deploying"],"tags":["zookeeper","sasl","kerberos","authentication"],"backgroundTag":"sasl-authentication-required","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}