{"record":{"id":"ab925409251aaa63","repo":"t8y2/dbx","slug":"zookeeper-authentication-failed-ab9254","errorCode":null,"errorMessage":"ZooKeeper authentication failed","messagePattern":"ZooKeeper authentication failed","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/zookeeper/connection.go","lineNumber":220,"sourceCode":"\tif err != nil {\n\t\treturn nil, err\n\t}\n\tconnected := false\n\ttimer := time.NewTimer(connectionTimeout)\n\tdefer timer.Stop()\n\tfor !connected {\n\t\tselect {\n\t\tcase event, open := <-events:\n\t\t\tif !open {\n\t\t\t\tconnection.Close()\n\t\t\t\treturn nil, errors.New(\"Connection timed out\")\n\t\t\t}\n\t\t\tif event.State == zk.StateHasSession {\n\t\t\t\tconnected = true\n\t\t\t}\n\t\t\tif event.State == zk.StateAuthFailed {\n\t\t\t\tconnection.Close()\n\t\t\t\treturn nil, errors.New(\"ZooKeeper authentication failed\")\n\t\t\t}\n\t\tcase <-timer.C:\n\t\t\tconnection.Close()\n\t\t\treturn nil, errors.New(\"Connection timed out\")\n\t\t}\n\t}\n\n\tif authScheme == defaultAuthScheme && strings.TrimSpace(config.Username) != \"\" {\n\t\tcredentials := []byte(strings.TrimSpace(config.Username) + \":\" + config.Password)\n\t\tif err := connection.AddAuth(defaultAuthScheme, credentials); err != nil {\n\t\t\tconnection.Close()\n\t\t\treturn nil, err\n\t\t}\n\t}\n\n\tprefix := joinPrefix(target.Chroot, config.Namespace)\n\tretryBase := defaultBaseSleepTime\n\tif config.BaseSleepTimeMS != nil {","sourceCodeStart":202,"sourceCodeEnd":238,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/zookeeper/connection.go#L202-L238","documentation":"After connecting, openClient watches session events for zk.StateAuthFailed. When the ZooKeeper server rejects the client's authentication (an ACL-auth failure event), the connection is closed and 'ZooKeeper authentication failed' is returned. It means the server refused the credentials presented for the digest auth scheme.","triggerScenarios":"The zk driver emits StateAuthFailed after openClient calls AddAuth with username:password digest credentials — i.e. the configured Username/Password do not match a digest user on the server, or SASL digest negotiation (negotiateSASLDigest) is rejected. Raised in agents/drivers/zookeeper/connection.go:220.","commonSituations":"Wrong username/password in the connection config; digest credentials not created on the ZooKeeper ensemble (no addauth digest user:pass done server-side); password changed or rotated; SASL/DIGEST-MD5 misconfigured on the server (jaasLoginContextName mismatch); chroot or ACLs denying the user.","solutions":["Verify Username and Password in the config match a digest user registered on the ZooKeeper ensemble (server side: addauth digest user:pass, then setAcl).","Re-create the credential after rotation and update the client config.","Check the server's SASL/jaas configuration (java.env, jaasLoginContextName) if DIGEST-MD5 is enforced.","Test the same credentials with zkCli.sh to confirm they are accepted before debugging this library."],"exampleFix":"// before\nconfig.Username = \"svc\"\nconfig.Password = \"old-pass\"\n// after\nconfig.Username = \"svc\"\nconfig.Password = \"correct-rotated-pass\"","handlingStrategy":"validation","validationCode":"// Validate credentials are present before connecting\nif cfg.Username != \"\" && cfg.Password == \"\" {\n    return errors.New(\"zookeeper auth: username set but password empty\")\n}\n// Optionally verify credentials out-of-band with zkCli before app start","typeGuard":null,"tryCatchPattern":"session, err := openClient(cfg)\nif err != nil {\n    if strings.Contains(err.Error(), \"authentication failed\") {\n        return fmt.Errorf(\"zookeeper credentials rejected; check Username/Password and server ACLs: %w\", err)\n    }\n    return err\n}","preventionTips":["Test credentials with zkCli.sh + addauth before deploying","Use a secret manager to keep Password in sync after rotations","Document which digest users must exist on the ensemble","Never enable digest auth server-side without first creating the user"],"tags":["authentication","zookeeper","sasl","credentials"],"backgroundTag":"authentication-failed","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}