{"record":{"id":"47652cade79b475a","repo":"GoogleContainerTools/jib","slug":"failed-to-authenticate-with-registry-registryurl","errorCode":null,"errorMessage":"Failed to authenticate with registry ${registryUrl}/${imageName}","messagePattern":"Failed to authenticate with registry (.+?)/(.+?)","errorType":"exception","errorClass":"RegistryAuthenticationFailedException","httpStatus":null,"severity":"error","filePath":"jib-core/src/main/java/com/google/cloud/tools/jib/registry/RegistryAuthenticator.java","lineNumber":305,"sourceCode":"\n        if (responseJson.getToken() == null) {\n          throw new RegistryAuthenticationFailedException(\n              registryUrl,\n              imageName,\n              \"Did not get token in authentication response from \"\n                  + getAuthenticationUrl(credential, repositoryScopes)\n                  + \"; parameters: \"\n                  + getAuthRequestParameters(credential, repositoryScopes));\n        }\n        return Authorization.fromBearerToken(responseJson.getToken());\n      }\n\n    } catch (ResponseException ex) {\n      if (ex.getStatusCode() == HttpStatusCodes.STATUS_CODE_UNAUTHORIZED\n          && ex.requestAuthorizationCleared()) {\n        throw new RegistryCredentialsNotSentException(registryUrl, imageName);\n      }\n      throw new RegistryAuthenticationFailedException(registryUrl, imageName, ex);\n\n    } catch (IOException ex) {\n      throw new RegistryAuthenticationFailedException(registryUrl, imageName, ex);\n    }\n  }\n}\n","sourceCodeStart":287,"sourceCodeEnd":312,"githubUrl":"https://github.com/GoogleContainerTools/jib/blob/fb949e2676afbbd7dd7a1ef61e20251931325654/jib-core/src/main/java/com/google/cloud/tools/jib/registry/RegistryAuthenticator.java#L287-L312","documentation":"RegistryAuthenticator.authenticate wraps any non-401-cleared ResponseException from the auth server in RegistryAuthenticationFailedException with the message 'Failed to authenticate with registry <registry>/<image>'. This is the generic authentication failure path for HTTP errors from the token endpoint.","triggerScenarios":"The token/auth endpoint returns an HTTP error (e.g., 401 without cleared-authorization semantics, 403, 500) during authenticate(); the ResponseException is not the credentials-not-sent case.","commonSituations":"Wrong password/expired token for the registry; auth server outage or 5xx; rate-limited auth endpoint; firewall/proxy blocking the auth realm host.","solutions":["Re-check registry username/password (docker login to verify)","Retry later or check the auth service status if the cause is a 5xx","Ensure the auth realm host is reachable from the build environment (proxy/firewall settings)","Inspect the cause (RegistryAuthenticationFailedException.getCause) for the actual HTTP status"],"exampleFix":"// before: stale password in CI secret\nPASSWORD=$OLD_SECRET\n// after: refresh secret\nPASSWORD=$(vault kv get -field=password secret/registry)","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try { authenticator.authenticate(scope); } catch (RegistryAuthenticationFailedException e) { if (e.getCause() instanceof ResponseException re && re.getStatusCode() >= 500) { retryLater(); } else { failWithCredentialHint(e); } }","preventionTips":["Rotate registry secrets regularly and sync them into CI","Check auth service health before large builds","Log the underlying cause to distinguish 4xx vs 5xx"],"tags":["registry","authentication","http"],"backgroundTag":"authentication-required","analyzedSha":"fb949e2676afbbd7dd7a1ef61e20251931325654","analyzedAt":"2026-09-06T14:04:09.491Z","contentChangedAt":"2026-09-06T14:04:09.491Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}