{"record":{"id":"df528089f98d367f","repo":"wezterm/wezterm","slug":"unhandled-auth-case-methods-status","errorCode":null,"errorMessage":"unhandled auth case; methods={:?}, status={:?}","messagePattern":"unhandled auth case; methods=(.+?), status=(.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"wezterm-ssh/src/auth.rs","lineNumber":247,"sourceCode":"                            echo: false,\n                        }],\n                        reply,\n                    }))\n                    .unwrap();\n\n                let mut answers = smol::block_on(answers.recv())\n                    .context(\"waiting for authentication answers from user\")\n                    .unwrap();\n                let pw = answers.remove(0);\n\n                match sess.userauth_password(None, Some(&pw))? {\n                    AuthStatus::Success => return Ok(()),\n                    AuthStatus::Partial => continue,\n                    status => anyhow::bail!(\"password auth status: {:?}\", status),\n                }\n            }\n\n            anyhow::bail!(\n                \"unhandled auth case; methods={:?}, status={:?}\",\n                auth_methods,\n                status_by_method\n            );\n        }\n    }\n\n    #[cfg(feature = \"ssh2\")]\n    pub fn authenticate(\n        &mut self,\n        sess: &ssh2::Session,\n        user: &str,\n        host: &str,\n    ) -> anyhow::Result<()> {\n        use std::collections::HashSet;\n\n        loop {\n            if sess.authenticated() {","sourceCodeStart":229,"sourceCodeEnd":265,"githubUrl":"https://github.com/wezterm/wezterm/blob/3ff7522b9617ec920f7fbdb22b57e93d42d93ee9/wezterm-ssh/src/auth.rs#L229-L265","documentation":"This is the terminal bail of wezterm's libssh auth loop: after trying publickey (agent auto), keyboard-interactive, and password, none returned Success/Partial, so the loop falls through and reports which methods the server offered plus the statuses recorded per method. It means the server's offered authentication methods and wezterm/libssh's capabilities did not intersect successfully.","triggerScenarios":"Session::authenticate_libssh where userauth_list returns only methods wezterm cannot satisfy — e.g. 'publickey' with no usable key in the agent, or 'hostbased'/'gssapi-with-mic' which wezterm never attempts — and the password/interactive arms are absent because the server didn't advertise them, or were tried and recorded a non-success status in status_by_method.","commonSituations":"Server configured with only publickey auth while the user has no agent/key loaded in the wezterm session; sites requiring GSSAPI/Kerberos; expired or non-existent default identity keys; agent (e.g. 1Password/ssh-agent socket) not visible to wezterm.","solutions":["Load a key the server accepts into ssh-agent (ssh-add) and confirm wezterm can see SSH_AUTH_SOCK, so userauth_public_key_auto succeeds","Check the methods=... part of the message: if it lists only methods wezterm doesn't do (hostbased, gssapi-with-mic), enable password or keyboard-interactive on the server or use a Kerberos-capable client","Verify the key file permissions and that the public key is in the server's authorized_keys","As a workaround, shell out: use wezterm's default domain with the system `ssh` binary instead of a wezterm ssh_domain"],"exampleFix":"-- before: wezterm ssh_domain without usable keys\n-- after: let the OS ssh handle exotic auth\nconfig.terminals = nil\n-- spawn the system ssh instead of an ssh_domain:\n-- wezterm.spawn_command... default: 'ssh host' via the local domain","handlingStrategy":"validation","validationCode":"# before relying on a wezterm ssh_domain, confirm the server offers a method you can satisfy\nssh -v user@host 2>&1 | grep -i 'authentications that can continue'","typeGuard":null,"tryCatchPattern":"On SessionEvent::Error containing 'unhandled auth case', guide the user to load keys into ssh-agent or use the system ssh client instead of retrying the domain.","preventionTips":["Load identity keys into ssh-agent and confirm SSH_AUTH_SOCK is inherited by wezterm","Pre-test each host with the CLI ssh client; if only exotic methods remain, use the local domain with system ssh"],"tags":["wezterm","ssh","libssh","authentication","publickey"],"backgroundTag":"ssh-no-supported-auth-method","analyzedSha":"3ff7522b9617ec920f7fbdb22b57e93d42d93ee9","analyzedAt":"2026-08-20T04:47:31.434Z","contentChangedAt":"2026-08-20T04:47:31.434Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}