{"record":{"id":"faee3164e98ce715","repo":"t8y2/dbx","slug":"zookeeper-authentication-failed","errorCode":null,"errorMessage":"ZooKeeper authentication failed","messagePattern":"ZooKeeper authentication failed","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/argo-go/discovery.go","lineNumber":210,"sourceCode":"\tdefer timer.Stop()\n\tfor {\n\t\tselect {\n\t\tcase <-ctx.Done():\n\t\t\treturn ctx.Err()\n\t\tcase <-timer.C:\n\t\t\treturn errors.New(\"ZooKeeper connection timed out before a session was established\")\n\t\tcase event, ok := <-events:\n\t\t\tif !ok {\n\t\t\t\treturn errors.New(\"ZooKeeper event stream closed before a session was established\")\n\t\t\t}\n\t\t\tif event.Err != nil {\n\t\t\t\treturn fmt.Errorf(\"ZooKeeper connection event: %w\", event.Err)\n\t\t\t}\n\t\t\tswitch event.State {\n\t\t\tcase zk.StateHasSession:\n\t\t\t\treturn nil\n\t\t\tcase zk.StateAuthFailed:\n\t\t\t\treturn errors.New(\"ZooKeeper authentication failed\")\n\t\t\tcase zk.StateExpired:\n\t\t\t\treturn errors.New(\"ZooKeeper session expired during connection\")\n\t\t\t}\n\t\t}\n\t}\n}\n\nfunc parseHiveServerRegistration(child string, data []byte) (endpoint, error) {\n\tcandidates := []string{strings.TrimSpace(string(data)), strings.TrimSpace(child)}\n\tfor _, candidate := range candidates {\n\t\tif candidate == \"\" {\n\t\t\tcontinue\n\t\t}\n\t\tif value, err := endpointFromRegistrationJSON(candidate); err == nil {\n\t\t\treturn value, nil\n\t\t}\n\t\tparameters := parseHiveParameters(candidate)\n\t\tfor _, key := range []string{\"serveruri\", \"hiveserver2uri\", \"server_uri\"} {","sourceCodeStart":192,"sourceCodeEnd":228,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/argo-go/discovery.go#L192-L228","documentation":"The ZooKeeper client delivered a connection event with state StateAuthFailed, meaning the server rejected the supplied authentication credentials (e.g. digest ACL mismatch). The wait loop converts this terminal state into this explicit error so callers know the session will not be usable.","triggerScenarios":"Endpoints() adds auth via AddAuth (authScheme/auth pair) and the ZooKeeper server responds with auth failure during session establishment; exercised by TestWaitForZooKeeperSessionRejectsAuthFailure.","commonSituations":"Wrong username/password in digest credentials; credentials not matching the znode ACLs; using a scheme the server does not support (e.g. sasl without Kerberos configured); stale credentials after a ZooKeeper config change.","solutions":["Correct the auth scheme/credentials so they match the ZooKeeper ACLs (digest 'user:password')","Verify Kerberos/SASL setup if using a scheme requiring external configuration","Connect without auth to a quorum/namespace whose ACLs permit anonymous read if that is intended"],"exampleFix":"// before\nauth: \"svc:user\" // wrong credential string\n// after\nauth: \"svc:correctpassword\"","handlingStrategy":"try-catch","validationCode":"// sanity check credentials before connecting\nif cfg.ZKAuthScheme == \"digest\" && !strings.Contains(cfg.ZKAuth, \":\") {\n\treturn errors.New(\"digest auth must be 'user:password'\")\n}","typeGuard":null,"tryCatchPattern":"endpoints, err := discovery.Endpoints(ctx)\nif err != nil {\n\tif strings.Contains(err.Error(), \"authentication failed\") {\n\t\t// do NOT retry with same credentials; surface config problem\n\t\treturn fmt.Errorf(\"check zookeeper authScheme/auth: %w\", err)\n\t}\n}","preventionTips":["Verify digest credentials against znode ACLs with zkCli addauth before deploying","Do not retry blindly on auth failure — it is terminal, not transient","Keep credentials in a secret store and rotate with matching ACL updates"],"tags":["zookeeper","authentication","credentials"],"backgroundTag":"authentication-failed","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}