{"record":{"id":"7e92f28d853c6eb6","repo":"jaegertracing/jaeger","slug":"authenticator-is-not-supported","errorCode":null,"errorMessage":"authenticator is not supported","messagePattern":"authenticator is not supported","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/storage/v2/grpc/factory.go","lineNumber":122,"sourceCode":"\ttelset telemetry.Settings,\n\ttracerProvider trace.TracerProvider,\n) component.TelemetrySettings {\n\treturn component.TelemetrySettings{\n\t\tLogger:         telset.Logger,\n\t\tTracerProvider: tracerProvider,\n\t\tMeterProvider:  telset.MeterProvider,\n\t}\n}\n\ntype newClientFn func(telset component.TelemetrySettings, gcs *configgrpc.ClientConfig, opts ...grpc.DialOption) (*grpc.ClientConn, error)\n\nfunc (f *Factory) initializeConnections(\n\treaderTelset, writerTelset component.TelemetrySettings,\n\treaderConfig, writerConfig *configgrpc.ClientConfig,\n\tnewClient newClientFn,\n) error {\n\tif f.config.Auth.HasValue() {\n\t\treturn errors.New(\"authenticator is not supported\")\n\t}\n\tconst maxRecvMsgSizeMiB = math.MaxInt / (1024 * 1024)\n\tif f.config.MaxRecvMsgSizeMiB < 0 || f.config.MaxRecvMsgSizeMiB > maxRecvMsgSizeMiB {\n\t\treturn fmt.Errorf(\"max_recv_msg_size_mib must be between 0 and %d, got %d\", maxRecvMsgSizeMiB, f.config.MaxRecvMsgSizeMiB)\n\t}\n\n\tunaryInterceptors := []grpc.UnaryClientInterceptor{bearertoken.NewUnaryClientInterceptor()}\n\tstreamInterceptors := []grpc.StreamClientInterceptor{bearertoken.NewStreamClientInterceptor()}\n\n\tif tenancyMgr := tenancy.NewManager(&f.config.Tenancy); tenancyMgr.Enabled {\n\t\tunaryInterceptors = append(unaryInterceptors, tenancy.NewClientUnaryInterceptor(tenancyMgr))\n\t\tstreamInterceptors = append(streamInterceptors, tenancy.NewClientStreamInterceptor(tenancyMgr))\n\t}\n\n\t// HeaderForwarding acts as an enable switch: header capture happens on the query\n\t// server side (HTTP/gRPC server interceptors); the client interceptors here simply\n\t// forward whatever was captured into outgoing metadata.\n\tif len(f.config.HeaderForwarding) > 0 {","sourceCodeStart":104,"sourceCodeEnd":140,"githubUrl":"https://github.com/jaegertracing/jaeger/blob/806f4447841ecdb60519f408b004a599d515f437/internal/storage/v2/grpc/factory.go#L104-L140","documentation":"This error is raised by initializeConnections in the gRPC storage v2 factory when the configuration sets an authenticator (config.Auth.HasValue()). The gRPC remote-storage client does not support authentication plugins in this code path, so NewFactory refuses to start with a clear message instead of silently ignoring the auth settings.","triggerScenarios":"Starting the Jaeger binary/component with a gRPC remote-storage configuration that includes an auth block (authenticator name) under the storage client config; initializeConnections checks f.config.Auth.HasValue() first and returns this error before dialing.","commonSituations":"Copying a config file from another storage plugin (e.g. one that supports authenticators) into the gRPC storage section; enabling auth for remote storage after a version change; operators assuming all storage plugins share the same auth support.","solutions":["Remove the auth/authenticator block from the gRPC storage client configuration.","Authenticate at the network layer instead (mTLS via tls settings, or a sidecar/proxy that terminates auth).","Check the version's documentation for supported auth options on the gRPC remote storage client.","If authentication is required, use a storage backend whose factory supports authenticators."],"exampleFix":"// before (yaml)\ngrpc:\n  server: jaeger-collector:14250\n  auth:\n    authenticator: bearer_token_auth\n// after\ngrpc:\n  server: jaeger-collector:14250\n  tls:\n    enabled: true","handlingStrategy":"validation","validationCode":"// Before starting the factory, strip/flag auth settings:\nif cfg.Auth.HasValue() {\n    return errors.New(\"grpc storage client does not support authenticators; remove auth block\")\n}","typeGuard":null,"tryCatchPattern":"factory, err := grpcv2.NewFactory(ctx, cfg, telset)\nif err != nil && strings.Contains(err.Error(), \"authenticator is not supported\") {\n    // fix config and restart\n}","preventionTips":["Do not copy auth blocks from other storage configs into the gRPC remote-storage section.","Use TLS/mTLS or an auth-terminating proxy for gRPC remote storage authentication needs.","Validate configs at deploy time with the component's own config validation to catch unsupported fields early."],"tags":["grpc","configuration","authentication"],"backgroundTag":"unsupported-authenticator-config","analyzedSha":"806f4447841ecdb60519f408b004a599d515f437","analyzedAt":"2026-09-01T02:39:22.140Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T05:18:18.240Z"}