{"record":{"id":"a7cd26bb558e73da","repo":"vitessio/vitess","slug":"unregistered-authenticator-implementation","errorCode":null,"errorMessage":"unregistered Authenticator implementation","messagePattern":"unregistered Authenticator implementation","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"go/vt/vtadmin/rbac/authentication.go","lineNumber":125,"sourceCode":"\t}\n\n\treturn context.WithValue(ctx, actorkey{}, actor)\n}\n\n// FromContext extracts an actor from the context, if one exists.\nfunc FromContext(ctx context.Context) (*Actor, bool) {\n\tactor, ok := ctx.Value(actorkey{}).(*Actor)\n\tif !ok {\n\t\treturn nil, false\n\t}\n\n\treturn actor, true\n}\n\nvar (\n\t// ErrUnregisteredAuthenticationImpl is returned when an RBAC config\n\t// specifies an authenticator name that was not registered.\n\tErrUnregisteredAuthenticationImpl = errors.New(\"unregistered Authenticator implementation\")\n\tauthenticators                    = map[string]func() Authenticator{}\n\tauthenticatorsM                   sync.Mutex\n)\n\n// RegisterAuthenticator registers an authenticator implementation by name. It\n// is not safe for concurrent use.\n//\n// Plugin-based authenticators are loaded separately, and need not call this\n// function.\nfunc RegisterAuthenticator(name string, f func() Authenticator) {\n\tif _, ok := authenticators[name]; ok {\n\t\tpanic(\"authenticator already registered with name: \" + name)\n\t}\n\n\tauthenticators[name] = f\n}\n\nfunc loadAuthenticatorPlugin(path string) (Authenticator, error) {","sourceCodeStart":107,"sourceCodeEnd":143,"githubUrl":"https://github.com/vitessio/vitess/blob/01a25a7d176f94613b8d59d799f438380a8760e4/go/vt/vtadmin/rbac/authentication.go#L107-L143","documentation":"ErrUnregisteredAuthenticationImpl is returned by rbac.Reify when the RBAC config names an authenticator that was never registered via RegisterAuthenticator. The package keeps a registry map of name-to-constructor pairs; Reify looks up the configured name and fails if it is absent. This is a configuration error, not a runtime failure of the authenticator itself.","triggerScenarios":"Setting `authenticators: [\"SomeAuth\"]` (or similar) in the vtadmin RBAC config where \"SomeAuth\" was never passed to RegisterAuthenticator before Reify is called; typo in the authenticator name; registering the authenticator in a different binary or after Reify runs.","commonSituations":"Copy-pasting vtadmin RBAC config from another deployment with custom authenticators compiled in; renaming an authenticator during a version upgrade; expecting a built-in authenticator to exist that is only registered by a specific build.","solutions":["Check the configured authenticator name against the names actually passed to rbac.RegisterAuthenticator in the vtadmin build you run","Register a custom implementation: call rbac.RegisterAuthenticator(\"yourname\", func() rbac.Authenticator { return yourAuth }) before Reify","Use a registered authenticator name (e.g. the default) in the RBAC config"],"exampleFix":"// before (config)\n{\"authenticators\": [\"Auth0Auth\"]}\n// after — register it before Reify\nrbac.RegisterAuthenticator(\"Auth0Auth\", func() rbac.Authenticator { return &MyAuth{} })\nrbac.Reify(config)","handlingStrategy":"validation","validationCode":"// before Reify\nrbac.RegisterAuthenticator(\"Auth0Auth\", func() rbac.Authenticator { return &MyAuth{} })\nif cfg.Authenticator != \"\" && !rbac.IsAuthenticatorRegistered(cfg.Authenticator) { /* fix config */ }","typeGuard":"func authenticatorRegistered(name string) bool {\n    _, ok := knownAuthenticators[name]\n    return ok\n}","tryCatchPattern":"actor, err := rc.Reify()\nif err != nil {\n    if errors.Is(err, rbac.ErrUnregisteredAuthenticationImpl) {\n        log.Fatalf(\"RBAC config names an unregistered authenticator: %v\", err)\n    }\n    return err\n}","preventionTips":["Keep authenticator registration in one place next to config parsing","Add a startup smoke test that Reifies the shipped default config","Compare config values against the registry in CI","Avoid hardcoding authenticator names in more than one place"],"tags":["vtadmin","rbac","configuration"],"backgroundTag":"unregistered-authenticator-implementation","analyzedSha":"01a25a7d176f94613b8d59d799f438380a8760e4","analyzedAt":"2026-09-01T17:28:30.605Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}