{"record":{"id":"fcb0a15e89ec8ebc","repo":"t8y2/dbx","slug":"zookeeper-session-closed-because-sasl-authenticati","errorCode":null,"errorMessage":"ZooKeeper session closed because SASL authentication is required","messagePattern":"ZooKeeper session closed because SASL authentication is required","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/argo-go/zookeeper_protocol.go","lineNumber":32,"sourceCode":"\t\"sync\"\n\t\"time\"\n\n\t\"github.com/beltran/gosasl\"\n\t\"github.com/go-zookeeper/zk\"\n)\n\nconst (\n\tzooKeeperProtocolVersion = int32(0)\n\tzooKeeperOpGetData       = int32(4)\n\tzooKeeperOpGetChildren2  = int32(12)\n\tzooKeeperOpClose         = int32(-11)\n\tzooKeeperOpSetAuth       = int32(100)\n\tzooKeeperOpSASL          = int32(102)\n\tzooKeeperMaxFrameSize    = 16 << 20\n\tzooKeeperMaxSASLRounds   = 8\n)\n\nvar errZooKeeperSessionClosedRequiresSASL = errors.New(\"ZooKeeper session closed because SASL authentication is required\")\n\ntype zooKeeperSASLClient interface {\n\tStart() ([]byte, error)\n\tStep([]byte) ([]byte, error)\n\tComplete() bool\n\tDispose()\n}\n\nvar newZooKeeperSASLClient = func(host string, config connectionConfig) (zooKeeperSASLClient, error) {\n\tservice, options := zooKeeperGSSAPIOptions(config)\n\tmechanism, err := gosasl.NewGSSAPIMechanismWithOptions(service, options)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\treturn gosasl.NewSaslClient(host, mechanism), nil\n}\n\nvar dialZooKeeperConnection = func(address string, timeout time.Duration, tlsConfig *tls.Config) (net.Conn, error) {","sourceCodeStart":14,"sourceCodeEnd":50,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/argo-go/zookeeper_protocol.go#L14-L50","documentation":"errZooKeeperSessionClosedRequiresSASL is a sentinel error returned by zooKeeperError when the ZooKeeper broker closes the session with error code -124, meaning the server requires SASL (Kerberos/GSSAPI) authentication but the client did not authenticate. It is checked with errors.Is and is stable for programmatic matching.","triggerScenarios":"Connecting to a ZooKeeper ensemble where the server enforces SASL (zookeeper.auth.enabled / quorum.auth) while the client connects without Kerberos credentials; calling authenticateSASL with a client whose SASL negotiation fails such that the server responds with -124.","commonSituations":"Pointing a non-Kerberized driver at a secured ZooKeeper ensemble; enabling Kerberos on Hive but not ZooKeeper client SASL; server-side security policy tightened (version/config change) breaking previously working unauthenticated clients.","solutions":["Enable Kerberos/SASL for the ZooKeeper connection (configure Hive Kerberos credentials so connectKerberosZooKeeper is used)","Verify the server's zoo.cfg requires SASL and match client jaas/keytab configuration accordingly","Check with errors.Is(err, errZooKeeperSessionClosedRequiresSASL) to distinguish auth-required from other ZooKeeper failures","Confirm clock skew and valid keytabs — failed GSSAPI setup can surface as server-rejected sessions"],"exampleFix":"// before\nzkConn, events, err := connectZooKeeper(servers, timeout, tlsConfig, connectionConfig{})\n// after\ncfg := connectionConfig{Kerberos: kerberos.Config{Enabled: true, /* keytab, principal... */}}\nzkConn, events, err := connectKerberosZooKeeper(servers, timeout, tlsConfig, cfg)","handlingStrategy":"validation","validationCode":"if !cfg.Kerberos.Enabled {\n    return errors.New(\"target ZooKeeper ensemble requires SASL; enable Kerberos credentials\")\n}","typeGuard":null,"tryCatchPattern":"conn, events, err := connectZooKeeper(...)\nif errors.Is(err, errZooKeeperSessionClosedRequiresSASL) {\n    // reconfigure with Kerberos/SASL enabled and reconnect\n}","preventionTips":["Match client SASL settings to the ensemble's zoo.cfg auth requirements","Enable Kerberos whenever the cluster is secured","Check errors.Is against the sentinel error, not string matching","Validate keytabs and clock sync before deploy"],"tags":["zookeeper","sasl","kerberos","authentication","go"],"backgroundTag":"sasl-authentication-required","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}