{"record":{"id":"b85a791aef977e16","repo":"t8y2/dbx","slug":"zookeeper-sasl-server-returned-error-d","errorCode":null,"errorMessage":"ZooKeeper SASL server returned error %d","messagePattern":"ZooKeeper SASL server returned error (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/zookeeper/sasl.go","lineNumber":141,"sourceCode":"\tbinary.BigEndian.PutUint32(payload[8:12], uint32(len(token)))\n\tcopy(payload[12:], token)\n\tif err := writeZooKeeperFrame(connection, payload); err != nil {\n\t\treturn nil, err\n\t}\n\tresponse, err := readZooKeeperFrame(connection)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tif len(response) < 20 {\n\t\treturn nil, errors.New(\"ZooKeeper SASL response is truncated\")\n\t}\n\tresponseXID := int32(binary.BigEndian.Uint32(response[4:8]))\n\tif responseXID != xid {\n\t\treturn nil, fmt.Errorf(\"ZooKeeper SASL response xid %d does not match request xid %d\", responseXID, xid)\n\t}\n\terrorCode := int32(binary.BigEndian.Uint32(response[16:20]))\n\tif errorCode != 0 {\n\t\treturn nil, fmt.Errorf(\"ZooKeeper SASL server returned error %d\", errorCode)\n\t}\n\tif len(response) < 24 {\n\t\treturn nil, errors.New(\"ZooKeeper SASL token is truncated\")\n\t}\n\ttokenLength := int(int32(binary.BigEndian.Uint32(response[20:24])))\n\tif tokenLength < 0 || tokenLength > zooKeeperMaximumFrameLen || 24+tokenLength > len(response) {\n\t\treturn nil, fmt.Errorf(\"ZooKeeper SASL token length %d is invalid\", tokenLength)\n\t}\n\treturn append([]byte(nil), response[24:24+tokenLength]...), nil\n}\n\nfunc readZooKeeperFrame(reader io.Reader) ([]byte, error) {\n\theader := make([]byte, 4)\n\tif _, err := io.ReadFull(reader, header); err != nil {\n\t\treturn nil, err\n\t}\n\tlength := int(int32(binary.BigEndian.Uint32(header)))\n\tif length < 0 || length > zooKeeperMaximumFrameLen {","sourceCodeStart":123,"sourceCodeEnd":159,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/zookeeper/sasl.go#L123-L159","documentation":"After XID validation, zooKeeperSASLRound reads bytes 16:20 as the server's error code. A nonzero code means the ZooKeeper server rejected the SASL operation for that round, and the code is surfaced in this error. This is the standard path by which authentication rejections (bad credentials) are reported.","triggerScenarios":"zooKeeperSASLRound receives a well-framed response whose errorCode field is nonzero — e.g. the server rejects the DIGEST-MD5 credentials or the SASL session state.","commonSituations":"Wrong username/password against a ZooKeeper with DigestAuthenticationProvider, server configured to require SASL while the client sent invalid auth, or server-side JAAS misconfiguration.","solutions":["Verify the digest username/password against the server's credential store (digest auth line in JAAS/zoo.cfg).","Check server logs for the matching SASL/authentication failure to see the exact ZooKeeper error code.","Confirm the server's authProvider includes the digest provider and the JAAS Server section is correct.","Fix credentials and retry authenticateSASLDigest."],"exampleFix":"// before\nopts := Options{SASL: true, SASLUser: \"admin\", SASLPassword: \"wrong\"}\n// after\nopts := Options{SASL: true, SASLUser: \"admin\", SASLPassword: \"correct-secret\"}","handlingStrategy":"retry","validationCode":"if creds.User == \"\" || creds.Password == \"\" { return errors.New(\"SASL credentials must be set\") }","typeGuard":null,"tryCatchPattern":"_, err := zooKeeperSASLRound(conn, xid, token)\nif err != nil && strings.Contains(err.Error(), \"server returned error\") {\n\t// Extract code, do not blindly retry auth failures\n\treturn classifyAuthFailure(err) // retry only for transient codes\n}","preventionTips":["Validate credentials out-of-band before enabling SASL.","Monitor server logs for SASL error codes correlated with client deployments.","Distinguish auth rejections (do not retry) from transient server errors (retry)."],"tags":["sasl","authentication","zookeeper","server-error"],"backgroundTag":"sasl-authentication-rejected","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}