{"record":{"id":"73abeb0cfc191214","repo":"juicedata/juicefs","slug":"smb-authentication-failed-v","errorCode":null,"errorMessage":"SMB authentication failed: %v","messagePattern":"SMB authentication failed: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/object/cifs.go","lineNumber":132,"sourceCode":"CREATE:\n\t// Create new connection\n\t// FIXME: may create a large number of connection in a short period, exceeding the limit.\n\tconn := &cifsConn{}\n\tconn.lastUsed = now\n\n\t// Establish SMB connection\n\taddress := net.JoinHostPort(c.host, c.port)\n\td := &smb2.Dialer{\n\t\tInitiator: &smb2.NTLMInitiator{\n\t\t\tUser:     c.user,\n\t\t\tPassword: c.password,\n\t\t},\n\t}\n\n\tvar err error\n\tconn.session, err = d.Dial(ctx, address)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"SMB authentication failed: %v\", err)\n\t}\n\n\tconn.share, err = conn.session.WithContext(ctx).Mount(c.share)\n\tif err != nil {\n\t\tc.closeConnection(conn)\n\t\treturn nil, fmt.Errorf(\"failed to mount SMB share %s: %v\", c.share, err)\n\t}\n\n\treturn conn, nil\n}\n\nfunc (c *cifsStore) closeConnection(conn *cifsConn) {\n\tif conn == nil || conn.session == nil {\n\t\treturn\n\t}\n\n\tsession := conn.session\n\tconn.session = nil","sourceCodeStart":114,"sourceCodeEnd":150,"githubUrl":"https://github.com/juicedata/juicefs/blob/c9a67b23e8e08ec23ec331aa6f1675e2319e921c/pkg/object/cifs.go#L114-L150","documentation":"cifsStore.getConnection dials the SMB server using go-smb2 with the configured credentials. If d.Dial(ctx, address) fails — which includes SMB handshake/authentication (NTLM/Kerberos) rejection — the error is wrapped as \"SMB authentication failed\".","triggerScenarios":"d.Dial fails because credentials (username/password/domain) are wrong, the SMB port is unreachable, the server requires unsupported SMB dialects, or NTLMv2/NTLMv1 negotiation fails.","commonSituations":"Wrong --smb-username/--smb-password values; domain prefix mismatch (DOMAIN\\\\user vs user); server only accepting SMB1 or enforcing encryption the client doesn't offer; network/firewall blocking port 445; account locked out.","solutions":["Verify username, password, and domain in the CIFS endpoint/configuration","Test credentials with smbclient -L //host -U 'DOMAIN\\\\user'","Confirm the server supports SMB2/SMB3 (disable SMB1-only requirement) and port 445 is reachable","Check server-side auth policy (NTLMv2 required vs NTLMv1) and account lockout status"],"exampleFix":"// before\n// endpoint: smb://fileserver/share?username=user&password=wrongpass\n// after\n// endpoint: smb://fileserver/share?username=DOMAIN%5Cuser&password=correctpass","handlingStrategy":"try-catch","validationCode":"// Shell: preflight SMB credentials\nsmbclient -L //fileserver -U 'DOMAIN\\\\user' -g >/dev/null || {\n  echo \"SMB auth failed\"; exit 1;\n}","typeGuard":null,"tryCatchPattern":"// Go\nobj, err := object.NewCifs(endpoint)\nif err != nil && strings.Contains(err.Error(), \"SMB authentication failed\") {\n    // prompt/rotate credentials; do not retry with same creds\n}","preventionTips":["Keep credentials in a secret store, URL-encode special characters","Confirm the server accepts SMB2/SMB3 and your NTLM version policy","Test auth with smbclient before production rollout"],"tags":["object-storage","smb","cifs","authentication"],"backgroundTag":"authentication-required","analyzedSha":"c9a67b23e8e08ec23ec331aa6f1675e2319e921c","analyzedAt":"2026-09-06T17:55:48.476Z","contentChangedAt":"2026-09-06T17:55:48.476Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}