{"record":{"id":"5fdef8c04e145e25","repo":"t8y2/dbx","slug":"zookeeper-authentication-failed-5fdef8","errorCode":null,"errorMessage":"ZooKeeper authentication failed","messagePattern":"ZooKeeper authentication failed","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/hive-go/discovery.go","lineNumber":210,"sourceCode":"\tdefer timer.Stop()\n\tfor {\n\t\tselect {\n\t\tcase <-ctx.Done():\n\t\t\treturn ctx.Err()\n\t\tcase <-timer.C:\n\t\t\treturn errors.New(\"ZooKeeper connection timed out before a session was established\")\n\t\tcase event, ok := <-events:\n\t\t\tif !ok {\n\t\t\t\treturn errors.New(\"ZooKeeper event stream closed before a session was established\")\n\t\t\t}\n\t\t\tif event.Err != nil {\n\t\t\t\treturn fmt.Errorf(\"ZooKeeper connection event: %w\", event.Err)\n\t\t\t}\n\t\t\tswitch event.State {\n\t\t\tcase zk.StateHasSession:\n\t\t\t\treturn nil\n\t\t\tcase zk.StateAuthFailed:\n\t\t\t\treturn errors.New(\"ZooKeeper authentication failed\")\n\t\t\tcase zk.StateExpired:\n\t\t\t\treturn errors.New(\"ZooKeeper session expired during connection\")\n\t\t\t}\n\t\t}\n\t}\n}\n\nfunc parseHiveServerRegistration(child string, data []byte) (endpoint, error) {\n\tcandidates := []string{strings.TrimSpace(string(data)), strings.TrimSpace(child)}\n\tfor _, candidate := range candidates {\n\t\tif candidate == \"\" {\n\t\t\tcontinue\n\t\t}\n\t\tif value, err := endpointFromRegistrationJSON(candidate); err == nil {\n\t\t\treturn value, nil\n\t\t}\n\t\tparameters := parseHiveParameters(candidate)\n\t\tfor _, key := range []string{\"serveruri\", \"hiveserver2uri\", \"server_uri\"} {","sourceCodeStart":192,"sourceCodeEnd":228,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/hive-go/discovery.go#L192-L228","documentation":"ZooKeeper signaled StateAuthFailed during connection: the credentials supplied via AddAuth were rejected by the ensemble, so the session can never be authorized and discovery aborts with this error. The session exists but ACL-protected nodes will be inaccessible.","triggerScenarios":"Calling Endpoints with authScheme/auth configured whose digest does not match the ACLs set on the discovery znode, producing a StateAuthFailed event in waitForZooKeeperSession.","commonSituations":"Wrong or rotated Hive/ZooKeeper digest password, auth configured for the wrong scheme (e.g. \"digest\" where ensemble expects \"sasl\"), typos in the user:password payload, or Kerberos/SASL mismatch.","solutions":["Verify auth credentials match the ACLs on the znode (getAcl via zkCli)","Confirm the authScheme string is exactly what the ensemble expects (\"digest\" vs \"sasl\")","Check the auth payload format is \"user:password\" for digest auth","Re-sync credentials after a password rotation and restart the client"],"exampleFix":"// before\ndiscovery.authScheme = \"digest\"\ndiscovery.auth = \"hive:oldpassword\"\n// after\ndiscovery.authScheme = \"digest\"\ndiscovery.auth = \"hive:newpassword\" // matches znode ACL","handlingStrategy":"validation","validationCode":"// verify credentials against the znode ACL before discovery\nfunc authMatchesACL(acl []zk.ACL, scheme, auth string) bool {\n    cred := scheme + \":\" + auth\n    for _, a := range acl {\n        if a.Scheme == scheme { return true }\n    }\n    return false\n}","typeGuard":null,"tryCatchPattern":"endpoints, err := discovery.Endpoints(ctx)\nif err != nil && strings.Contains(err.Error(), \"authentication failed\") {\n    return fmt.Errorf(\"check ZooKeeper authScheme/auth against znode ACLs: %w\", err)\n}","preventionTips":["Cross-check auth credentials against `getAcl` output for the discovery znode","Update credentials promptly after password rotation","Use the exact scheme name the ensemble enforces (digest vs sasl)"],"tags":["zookeeper","authentication","acl","sasl"],"backgroundTag":"auth-failed","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}