{"record":{"id":"3cea914c1181125f","repo":"t8y2/dbx","slug":"start-zookeeper-digest-md5-negotiation-w","errorCode":null,"errorMessage":"start ZooKeeper DIGEST-MD5 negotiation: %w","messagePattern":"start ZooKeeper DIGEST-MD5 negotiation: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/zookeeper/sasl.go","lineNumber":92,"sourceCode":"\ntype saslClient interface {\n\tStart() ([]byte, error)\n\tStep(challenge []byte) ([]byte, error)\n\tComplete() bool\n}\n\nfunc negotiateSASLDigest(connection net.Conn, timeout time.Duration, saslClient saslClient) error {\n\tif timeout <= 0 {\n\t\ttimeout = defaultConnectionTimeout\n\t}\n\tif err := connection.SetDeadline(time.Now().Add(timeout)); err != nil {\n\t\treturn err\n\t}\n\tdefer connection.SetDeadline(time.Time{})\n\n\ttoken, err := saslClient.Start()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"start ZooKeeper DIGEST-MD5 negotiation: %w\", err)\n\t}\n\tfor round := 0; round < zooKeeperSASLMaxRounds; round++ {\n\t\tchallenge, err := zooKeeperSASLRound(connection, zooKeeperSASLXIDBase+int32(round), token)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"ZooKeeper SASL round %d: %w\", round+1, err)\n\t\t}\n\t\tif saslClient.Complete() {\n\t\t\tif len(challenge) != 0 {\n\t\t\t\treturn errors.New(\"ZooKeeper sent an unexpected token after DIGEST-MD5 completion\")\n\t\t\t}\n\t\t\treturn nil\n\t\t}\n\t\ttoken, err = saslClient.Step(challenge)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"continue ZooKeeper DIGEST-MD5 negotiation at round %d: %w\", round+1, err)\n\t\t}\n\t\tif saslClient.Complete() {\n\t\t\tif len(token) != 0 {","sourceCodeStart":74,"sourceCodeEnd":110,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/zookeeper/sasl.go#L74-L110","documentation":"negotiateSASLDigest begins a DIGEST-MD5 SASL handshake with ZooKeeper. This error wraps a failure returned by saslClient.Start(), i.e. the client could not even produce the initial authentication token — typically because the SASL credentials (username/password) are missing or malformed. It is raised before any round-trip with the server.","triggerScenarios":"authenticateSASLDigest calls negotiateSASLDigest; the underlying saslClient.Start() returns an error (invalid or empty username/password, mis-initialized SASL client) and the error is wrapped with this message.","commonSituations":"Missing or empty digest username/password in connection config, wrong auth scheme selected for the server's mechanism, or building the SASL client with options it does not support.","solutions":["Verify the SASL username and password supplied to authenticateSASLDigest are non-empty and correct.","Check the server's zoo.cfg auth configuration accepts DIGEST-MD5 (authProvider.1 = org.apache.zookeeper.server.auth.DigestAuthenticationProvider).","Inspect the wrapped inner error (%w) in logs to see the exact Start() failure.","Confirm the SASL client library version matches the mechanism you configured."],"exampleFix":"// before\nconnOpts := Options{Host: \"zk:2181\", SASL: true} // no credentials\n// after\nconnOpts := Options{Host: \"zk:2181\", SASL: true, SASLUser: \"admin\", SASLPassword: \"secret\"}","handlingStrategy":"validation","validationCode":"func saslCredsValid(user, pass string) bool { return user != \"\" && pass != \"\" }\nif !saslCredsValid(opts.SASLUser, opts.SASLPassword) {\n\treturn errors.New(\"SASL credentials required for DIGEST-MD5 auth\")\n}","typeGuard":null,"tryCatchPattern":"if err := authenticateSASLDigest(conn, creds); err != nil {\n\tvar inner error\n\tif errors.As(err, &inner) { log.Printf(\"SASL start failed: %v\", inner) }\n\treturn fmt.Errorf(\"sasl auth: %w\", err)\n}","preventionTips":["Validate SASL username/password are non-empty before dialing.","Keep credentials in env/secret manager and verify they load correctly at startup.","Smoke-test SASL auth against a staging ZooKeeper with the same JAAS config."],"tags":["sasl","authentication","zookeeper","digest-md5"],"backgroundTag":"sasl-handshake-failed","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}