{"record":{"id":"975acdd340ae5d8f","repo":"aeron-io/aeron","slug":"replication-does-not-support-challenge-response","errorCode":null,"errorMessage":"Replication does not support challenge/response authentication","messagePattern":"Replication does not support challenge/response authentication","errorType":"exception","errorClass":"ArchiveException","httpStatus":null,"severity":"error","filePath":"aeron-archive/src/main/java/io/aeron/archive/ReplicationCredentialsSupplier.java","lineNumber":37,"sourceCode":"import io.aeron.security.CredentialsSupplier;\n\nclass ReplicationCredentialsSupplier implements CredentialsSupplier\n{\n    private final byte[] encodedCredentials;\n\n    ReplicationCredentialsSupplier(final byte[] encodedCredentials)\n    {\n        this.encodedCredentials = encodedCredentials;\n    }\n\n    public byte[] encodedCredentials()\n    {\n        return encodedCredentials;\n    }\n\n    public byte[] onChallenge(final byte[] encodedChallenge)\n    {\n        throw new ArchiveException(\"Replication does not support challenge/response authentication\");\n    }\n}\n","sourceCodeStart":19,"sourceCodeEnd":40,"githubUrl":"https://github.com/aeron-io/aeron/blob/6d60124e15e35c11b49ba2e3c2c2858a09a18803/aeron-archive/src/main/java/io/aeron/archive/ReplicationCredentialsSupplier.java#L19-L40","documentation":"ReplicationCredentialsSupplier implements the credentials callback interface but deliberately does not support challenge/response authentication: onChallenge always throws ArchiveException. Aeron archive replication only supports a static encodedCredentials supplied up front; if the source archive demands a challenge, replication cannot satisfy it.","triggerScenarios":"onChallenge (part of the AuthenticatedSessionProxy callback flow) is invoked when the source archive's authentication service responds to the connect credentials with a challenge rather than accepting them immediately — i.e. the remote archive is configured with an authenticator that issues challenges (e.g. SessionProxyChallenge). Any replication started against such an archive will throw this.","commonSituations":"Replicating from an archive whose authenticator requires challenge/response (e.g. a challenge-based AcceptanceAuthenticator) while the replicating side supplies only static encodedCredentials via ReplicationParams; copying a client configuration that worked for normal archive clients (which do support challenge/response) to the replication API, which does not.","solutions":["Reconfigure the source archive's authentication service to accept the static credentials without issuing a challenge (e.g. accept the encoded credentials in onConnectRequest)","Supply the exact credentials the source archive expects up front via .sourceCredentials()/replicationCredentials in ReplicationParams so no challenge round-trip occurs","If challenge/response is required, implement replication through the regular archive client APIs instead of the replication feature","Catch the ArchiveException at replication start and surface a clear configuration error to the operator"],"exampleFix":"// before: replication against a challenge-based authenticator\nReplicationParams params = new ReplicationParams()\n    .sourceCredentials(encodedCredentials);\n\n// after: source archive authenticator accepts without challenge\npublic long onConnectRequest(...) { return acceptSession(...); } // no challenge issued\n// or use a plain archive client to drive replication when challenges are mandatory","handlingStrategy":"validation","validationCode":"// before replicating, confirm the source archive's authenticator accepts static credentials\nif (sourceArchiveRequiresChallenge) {\n    throw new ConfigurationException(\"replication needs a non-challenge authenticator on the source archive\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    replicationId = archive.replicate(recordingId, dstRecordingId, srcControlChannel, srcReplicationChannel);\n} catch (ArchiveException e) {\n    if (e.getMessage().contains(\"challenge/response\")) {\n        throw new ConfigurationException(\"source archive demands challenge/response; replication unsupported — reconfigure authenticator\");\n    }\n    throw e;\n}","preventionTips":["Configure the source archive's authenticator to accept static encoded credentials without a challenge when replication is used","Do not reuse challenge-based client auth configurations for the replication API","If challenge/response is a hard requirement, implement the copy with a regular AeronArchive client rather than replicate()","Document authentication expectations for both archives in deployment configs to catch mismatches early"],"tags":["archive","replication","authentication","unsupported"],"backgroundTag":"unsupported-operation","analyzedSha":"6d60124e15e35c11b49ba2e3c2c2858a09a18803","analyzedAt":"2026-09-12T11:17:07.683Z","contentChangedAt":"2026-09-12T11:17:07.683Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}