{"record":{"id":"4b4f0b3a8aef3718","repo":"t8y2/dbx","slug":"continue-zookeeper-gssapi-negotiation-at-round-d-4b4f0b","errorCode":null,"errorMessage":"continue ZooKeeper GSSAPI negotiation at round %d: %w","messagePattern":"continue ZooKeeper GSSAPI negotiation at round (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/hive-go/zookeeper_protocol.go","lineNumber":226,"sourceCode":"\t\t\tencoder.bytes(token)\n\t\t})\n\t\tif requestErr != nil {\n\t\t\treturn fmt.Errorf(\"ZooKeeper SASL round %d: %w\", round+1, requestErr)\n\t\t}\n\t\tdecoder := newZooKeeperDecoder(response)\n\t\tchallenge, decodeErr := decoder.bytes()\n\t\tif decodeErr != nil {\n\t\t\treturn fmt.Errorf(\"decode ZooKeeper SASL round %d: %w\", round+1, decodeErr)\n\t\t}\n\t\tif saslClient.Complete() {\n\t\t\tif len(challenge) != 0 {\n\t\t\t\treturn errors.New(\"ZooKeeper sent an unexpected token after GSSAPI completion\")\n\t\t\t}\n\t\t\treturn nil\n\t\t}\n\t\ttoken, err = saslClient.Step(challenge)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"continue ZooKeeper GSSAPI negotiation at round %d: %w\", round+1, err)\n\t\t}\n\t}\n\treturn fmt.Errorf(\"ZooKeeper GSSAPI negotiation exceeded %d rounds\", zooKeeperMaxSASLRounds)\n}\n\nfunc (client *protocolZooKeeperClient) AddAuth(scheme string, auth []byte) error {\n\t_, err := client.request(zooKeeperOpSetAuth, func(encoder *zooKeeperEncoder) {\n\t\tencoder.int32(0)\n\t\tencoder.string(scheme)\n\t\tencoder.bytes(auth)\n\t})\n\treturn err\n}\n\nfunc (client *protocolZooKeeperClient) Children(path string) ([]string, *zk.Stat, error) {\n\tresponse, err := client.request(zooKeeperOpGetChildren2, func(encoder *zooKeeperEncoder) {\n\t\tencoder.string(path)\n\t\tencoder.boolean(false)","sourceCodeStart":208,"sourceCodeEnd":244,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/hive-go/zookeeper_protocol.go#L208-L244","documentation":"Returned by protocolZooKeeperClient.authenticateSASL when the GSSAPI client's Step() call fails while processing a ZooKeeper challenge at round N — the Kerberos library rejected the server's token (bad session key, malformed token, principal mismatch). The wrapped error carries the GSSAPI detail.","triggerScenarios":"Thrown at agents/drivers/hive-go/zookeeper_protocol.go:226 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Check the wrapped GSSAPI error for the Kerberos cause","Ensure agent and ZooKeeper share the same KDC and enctypes","Validate the ZooKeeper server's service principal and keytab","Re-acquire tickets (kinit) and retry"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}