{"record":{"id":"c969a2271bbaea36","repo":"t8y2/dbx","slug":"password-is-required-when-auth-scheme-sasl-dige","errorCode":null,"errorMessage":"password is required when auth_scheme = \"sasl_digest\"","messagePattern":"password is required when auth_scheme = \"sasl_digest\"","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/zookeeper/connection.go","lineNumber":162,"sourceCode":"\t\tresult[\"databaseInfo\"] = info\n\t}\n\treturn result, nil\n}\n\nfunc openClient(config connectionConfig) (*clientSession, error) {\n\tif hasTLSOptions(config) {\n\t\treturn nil, errors.New(\"ZooKeeper TLS is not supported\")\n\t}\n\tauthScheme := resolveAuthScheme(config)\n\tif authScheme != defaultAuthScheme && authScheme != saslDigestAuthScheme {\n\t\treturn nil, fmt.Errorf(\"Unsupported auth_scheme %q; expected %q or %q\", authScheme, defaultAuthScheme, saslDigestAuthScheme)\n\t}\n\tif authScheme == saslDigestAuthScheme {\n\t\tif strings.TrimSpace(config.Username) == \"\" {\n\t\t\treturn nil, errors.New(`username is required when auth_scheme = \"sasl_digest\"`)\n\t\t}\n\t\tif config.Password == \"\" {\n\t\t\treturn nil, errors.New(`password is required when auth_scheme = \"sasl_digest\"`)\n\t\t}\n\t}\n\tif config.BaseSleepTimeMS != nil && *config.BaseSleepTimeMS < 0 {\n\t\treturn nil, errors.New(\"base_sleep_time_ms must be non-negative\")\n\t}\n\tif config.MaxRetries != nil && *config.MaxRetries < 0 {\n\t\treturn nil, errors.New(\"max_retries must be non-negative\")\n\t}\n\tmaxBufferSize, err := resolveMaxBufferSize(config)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\ttarget, err := parseConnectTarget(connectionString(config))\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tconnectionTimeout := millisecondsOrDefault(config.ConnectionTimeoutMS, defaultConnectionTimeout)","sourceCodeStart":144,"sourceCodeEnd":180,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/zookeeper/connection.go#L144-L180","documentation":"Returned by openClient in the zookeeper driver when auth_scheme is sasl_digest but the password configuration is empty. SASL DIGEST-MD5 authentication requires both username and password; this guard fires during connect/test_connection after the username check, before any ZooKeeper connection is attempted.","triggerScenarios":"connectionConfig has auth_scheme = \"sasl_digest\", Username is set, but Password is an empty string at connection time.","commonSituations":"Password stored in an env var or secret that is unset/empty in the environment; config template with password left as placeholder removed; interactive prompt skipped in CI.","solutions":["Set the password in the connection config when using sasl_digest","Verify the secret/env source resolves to a non-empty value before connecting","Use the default auth scheme if anonymous/no-auth access is intended","Check ZooKeeper server logs afterward to confirm the SASL handshake succeeds"],"exampleFix":"// before\ncfg := connectionConfig{AuthScheme: \"sasl_digest\", Username: \"zkuser\"} // password empty\n// after\ncfg := connectionConfig{AuthScheme: \"sasl_digest\", Username: \"zkuser\", Password: os.Getenv(\"ZK_PASSWORD\")}","handlingStrategy":"validation","validationCode":"if cfg.AuthScheme == \"sasl_digest\" && cfg.Password == \"\" {\n    return errors.New(\"password is required when auth_scheme = sasl_digest\")\n}","typeGuard":null,"tryCatchPattern":"_, err := openClient(cfg)\nif err != nil && strings.Contains(err.Error(), \"password is required\") {\n    return fmt.Errorf(\"check secret injection for ZK password: %w\", err)\n}","preventionTips":["Verify secret-manager/env values are populated before building the config","Never leave password placeholders (empty or \"changeme\") in deployed configs","Set username and password atomically when switching to sasl_digest","Test SASL auth against a staging ZooKeeper with matching ACLs"],"tags":["zookeeper","authentication","sasl","configuration"],"backgroundTag":"missing-credentials","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}