{"record":{"id":"59a28e9723dac3f9","repo":"cube-js/cube","slug":"sasl-error-payload-tostring-utf-8","errorCode":null,"errorMessage":"SASL Error: ${payload.toString('utf-8')}","messagePattern":"SASL Error: (.+?)","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/cubejs-hive-driver/src/TSaslTransport.js","lineNumber":130,"sourceCode":"      const saslTransport = new thrift.TBufferedTransport(null, callback);\n      const messageHeader = Buffer.alloc(5);\n      messageHeader.writeInt8(status);\n      messageHeader.writeUInt32BE(payload.length, 1);\n      saslTransport.write(messageHeader);\n      saslTransport.write(payload);\n      saslTransport.flush();\n    }\n\n    static receiveSaslMessage(transport) {\n      const buffer = transport.read(5);\n      const status = buffer.readInt8();\n      const payloadSize = buffer.readUInt32BE(1);\n      if (payloadSize < 0 || payloadSize > 104857600) {\n        throw new Error(`Incorrect payload size in SASL message: ${payloadSize}`);\n      }\n      const payload = transport.read(payloadSize);\n      if (status === BAD || status === ERROR) {\n        throw new Error(`SASL Error: ${payload.toString('utf-8')}`);\n      }\n      return { status, payload };\n    }\n  }\n\n  return TSaslTransport;\n};\n","sourceCodeStart":112,"sourceCodeEnd":138,"githubUrl":"https://github.com/cube-js/cube/blob/7d981676b36392fec34088b9afab6bdcad40207c/packages/cubejs-hive-driver/src/TSaslTransport.js#L112-L138","documentation":"After reading a SASL frame in TSaslTransport.receiveSaslMessage, if the status byte is BAD or ERROR the driver throws an Error whose message is 'SASL Error: ' plus the UTF-8 payload the server returned. The payload text comes from the server, so this is the server rejecting the SASL negotiation (auth failure, unsupported mechanism, etc.).","triggerScenarios":"During SASL handshake, server replies with status BAD or ERROR — e.g. wrong username/password for PLAIN auth, server not configured for the offered mechanism, or server policy rejecting the client.","commonSituations":"Wrong CUBEJS_DB_USER/CUBEJS_DB_PASS credentials against Hive with LDAP/Kerberos/plain auth; cluster requiring Kerberos while driver performs PLAIN; auth mechanism disabled on the server.","solutions":["Read the server-provided payload text after 'SASL Error:' — it names the actual reason","Verify username/password credentials for the Hive/Impala endpoint","Confirm the server's authentication mechanism (NONE/PLAIN/LDAP/KERBEROS) and configure the driver to match","Enable client-side SASL debugging/logging to inspect the negotiation steps"],"exampleFix":"// before: wrong mechanism for the cluster\nnew HiveDriver({ username: 'user', password: 'pass' }); // server requires Kerberos\n// after: use a Kerberos-capable configuration or enable matching auth on server\nnew HiveDriver({ username: 'user', kerberos: true /* plus keytab/principal */, ... });","handlingStrategy":"try-catch","validationCode":"// Validate credentials/mechanism before connecting\nif (!process.env.CUBEJS_DB_USER || !process.env.CUBEJS_DB_PASS) {\n  throw new Error('Hive credentials missing: SASL negotiation will fail');\n}","typeGuard":null,"tryCatchPattern":"try {\n  await driver.testConnection();\n} catch (e) {\n  if (String(e.message).startsWith('SASL Error:')) {\n    const serverReason = e.message.slice('SASL Error:'.length).trim();\n    console.error('Server rejected SASL negotiation:', serverReason);\n    // route to credential/mechanism fix\n  } else throw e;\n}","preventionTips":["Verify username/password against the Hive/Impala auth backend before deploying","Confirm server auth mechanism (NONE/PLAIN/LDAP/KERBEROS) matches driver config","Log the full 'SASL Error:' payload — the server states the exact rejection reason","Test auth with beeline using the same user/mechanism to isolate driver vs server issues"],"tags":["sasl","authentication","hive","thrift"],"backgroundTag":"sasl-authentication-failed","analyzedSha":"7d981676b36392fec34088b9afab6bdcad40207c","analyzedAt":"2026-09-02T03:45:10.400Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}