{"record":{"id":"56c19c588e81a080","repo":"cube-js/cube","slug":"sasl-failed-with-status-status-payload-tostr","errorCode":null,"errorMessage":"SASL Failed with status ${status}: ${payload.toString('utf-8')}","messagePattern":"SASL Failed with status (.+?): (.+?)","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/cubejs-hive-driver/src/TSaslTransport.js","lineNumber":94,"sourceCode":"            TSaslTransport.sendSaslMessage(OK, Buffer.from(payload, 'utf-8'), callback);\n          }\n        } else {\n          sendFrame(data, seqId, callback);\n        }\n      });\n    }\n\n    static receiver(callback, seqid) {\n      const receiver = thrift.TBufferedTransport.receiver(callback, seqid);\n\n      let frame = null;\n\n      return (data) => {\n        if (!saslComplete) {\n          thrift.TBufferedTransport.receiver((transport) => {\n            const { status, payload } = TSaslTransport.receiveSaslMessage(transport);\n            if (status !== COMPLETE) {\n              throw new Error(`SASL Failed with status ${status}: ${payload.toString('utf-8')}`);\n            }\n            saslComplete = true;\n            flushPendingData();\n          })(data);\n        } else {\n          if (!frame) {\n            frame = new Frame();\n          }\n          const frames = frame.read(data, 0);\n\n          frames.filter(f => f.fullyRead).map(f => receiver(f.buffer));\n          frame = frames.find(f => !f.fullyRead);\n        }\n      };\n    }\n\n    static sendSaslMessage(status, payload, callback) {\n      const saslTransport = new thrift.TBufferedTransport(null, callback);","sourceCodeStart":76,"sourceCodeEnd":112,"githubUrl":"https://github.com/cube-js/cube/blob/7d981676b36392fec34088b9afab6bdcad40207c/packages/cubejs-hive-driver/src/TSaslTransport.js#L76-L112","documentation":"TSaslTransport's receiver callback performs the SASL handshake for the Thrift transport used to talk to Hive. receiveSaslMessage() parses the server's SASL status and payload; if the status is not COMPLETE (e.g. BAD or FAIL), the server rejected authentication and the negotiated server message is included in the thrown error.","triggerScenarios":"Opening a Hive connection where the SASL handshake response status is not COMPLETE — wrong username/password, server configured for a different SASL mechanism (e.g. DIGEST-MD5 vs PLAIN), Kerberos vs LDAP mismatch, or the server sending a malformed/short SASL frame that yields an unexpected status.","commonSituations":"HiveServer2 with LDAP auth and wrong CUBEJS_DB_USER/PASS; cluster configured for Kerberos/GSSAPI while the client uses PLAIN; Hive behind a proxy mangling the negotiated frames; mixed Hive versions negotiating incompatible mechanisms.","solutions":["Verify CUBEJS_DB_USER/CUBEJS_DB_PASSWORD match the credentials Hive expects for its configured auth mechanism.","Match the SASL mechanism: if Hive uses Kerberos, configure Kerberos (principal/keytab) rather than PLAIN username/password.","Check the payload in the error message — it usually contains Hive's own auth failure reason (e.g. 'Error validating LDAP user').","Confirm HiveServer2 auth settings in hive-site.xml (hive.server2.authentication) align with the driver config."],"exampleFix":"// before (.env)\nCUBEJS_DB_USER=hive\nCUBEJS_DB_PASS=wrongpass\n// after\nCUBEJS_DB_USER=hive\nCUBEJS_DB_PASS=correct_password\n# or, for Kerberos clusters, supply principal/keytab config instead of PLAIN credentials","handlingStrategy":"try-catch","validationCode":"if (!process.env.CUBEJS_DB_USER || !process.env.CUBEJS_DB_PASS) {\n  throw new Error('Hive credentials required for SASL authentication');\n}","typeGuard":"function isSaslAuthError(e) {\n  return e instanceof Error && /^SASL Failed with status/.test(e.message);\n}","tryCatchPattern":"try {\n  await hiveDriver.query(sql);\n} catch (e) {\n  if (/^SASL Failed with status/.test(e.message || '')) {\n    console.error('Hive SASL auth failed — check credentials/mechanism:', e.message);\n    // do not retry blindly; auth failures are not transient\n    throw e;\n  }\n  throw e;\n}","preventionTips":["Verify CUBEJS_DB_USER/PASS against HiveServer2's configured auth (LDAP/PLAIN/Kerberos)","Match the SASL mechanism the cluster negotiates; use Kerberos config for GSSAPI clusters","Read the payload in the error message — it contains Hive's own failure reason","Test connectivity with beeline using the same credentials before deploying"],"tags":["authentication","sasl","hive","thrift","network"],"backgroundTag":"sasl-authentication-failed","analyzedSha":"7d981676b36392fec34088b9afab6bdcad40207c","analyzedAt":"2026-09-02T03:45:10.400Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}