{"record":{"id":"470457fef20ba8e7","repo":"juicedata/juicefs","slug":"auth-s","errorCode":null,"errorMessage":"Auth: %s","messagePattern":"Auth: %s","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/object/swift.go","lineNumber":159,"sourceCode":"\t\treturn nil, fmt.Errorf(\"Invalid host: %s\", uri.Host)\n\t}\n\tcontainer := hostSlice[0]\n\thost := hostSlice[1]\n\n\t// current only support V1 authentication\n\tauthURL := uri.Scheme + \"://\" + host + \"/auth/v1.0\"\n\n\tconn := swift.Connection{\n\t\tUserName:  username,\n\t\tApiKey:    apiKey,\n\t\tAuthToken: token,\n\t\tAuthUrl:   authURL,\n\t\tUserAgent: UserAgent,\n\t\tTransport: httpClient.Transport.(*http.Transport),\n\t}\n\terr = conn.Authenticate(context.Background())\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"Auth: %s\", err)\n\t}\n\treturn &swiftOSS{DefaultObjectStorage{}, &conn, conn.Region, conn.StorageUrl, container}, nil\n}\n\nfunc init() {\n\tRegister(\"swift\", newSwiftOSS)\n}\n","sourceCodeStart":141,"sourceCodeEnd":167,"githubUrl":"https://github.com/juicedata/juicefs/blob/c9a67b23e8e08ec23ec331aa6f1675e2319e921c/pkg/object/swift.go#L141-L167","documentation":"newSwiftOSS wraps any failure from the swift library's conn.Authenticate() with the prefix \"Auth: \". It means the OpenStack Swift credentials/endpoint were rejected or unreachable during the initial authentication handshake, so no swiftOSS client can be constructed.","triggerScenarios":"juicefs format/mount with a swift:// URL where Authenticate() fails: wrong username/password/domain, bad auth URL, missing or wrong tenant/project name, unreachable Keystone server, or expired token.","commonSituations":"Misconfigured SWIFT credentials in storage config; OpenStack Keystone endpoint behind firewall; using v2 auth API against a server that only supports v3 (or vice versa); project/tenant name omitted when required.","solutions":["Verify auth URL, username, password, tenant/project (and domain for v3) in the swift connection string","Test authentication against the same Keystone endpoint with curl or the openstack CLI","Check network reachability/DNS/TLS to the auth URL from the client host","Ensure the swift library auth version (v1/v2/v3) matches the server"],"exampleFix":"// before\nstorage = \"swift\"\nmetaurl = \"...\"\n// swift URL missing project: swift://container/authURL/user/pass\n// after\n// full swift URL with tenant/project: swift://container/https://auth.example.com/v3/user/pass/project","handlingStrategy":"validation","validationCode":"func validSwiftAuth(u *url.URL) error {\n\tif u.Scheme != \"swift\" { return fmt.Errorf(\"scheme must be swift, got %s\", u.Scheme) }\n\tparts := strings.SplitN(strings.TrimPrefix(u.Opaque, \"//\"), \"/\", 4)\n\tif len(parts) < 4 { return errors.New(\"swift URL needs container/authURL/user/pass\") }\n\tif !strings.HasPrefix(parts[1], \"http\") { return errors.New(\"auth URL missing scheme\") }\n\treturn nil\n}","typeGuard":null,"tryCatchPattern":"_, err := object.CreateStorage(ctx, \"swift\", url, \"\", \"\")\nif err != nil && strings.HasPrefix(err.Error(), \"Auth:\") {\n\t// inspect credentials/keystone before retrying\n}","preventionTips":["Test the swift auth URL with the openstack CLI before configuring juicefs","Include tenant/project and domain explicitly for Keystone v3","Check network reachability to the Keystone endpoint from the client host"],"tags":["swift","openstack","authentication","object-storage"],"backgroundTag":"authentication-required","analyzedSha":"c9a67b23e8e08ec23ec331aa6f1675e2319e921c","analyzedAt":"2026-09-06T17:55:48.476Z","contentChangedAt":"2026-09-06T17:55:48.476Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}