cloudflare/cloudflared · error

unknown authentication type

Error message

unknown authentication type

What it means

After reading the client's offered auth methods, StandardAuthHandler.Handle selects the first method it has an authenticator for. If none of the client's methods is supported, it writes a 0x01 'no acceptable methods' reply and returns this error. It means auth negotiation found no mutually supported method.

Source

Thrown at socks/auth_handler.go:63

// Handle gets the methods from the SOCKS5 client and authenticates with the first supported method
func (h *StandardAuthHandler) Handle(bufConn io.Reader, conn io.Writer) error {
	methods, err := readMethods(bufConn)
	if err != nil {
		return fmt.Errorf("Failed to read auth methods: %v", err)
	}

	// first supported method is used
	for _, method := range methods {
		authenticator := h.authenticators[method]
		if authenticator != nil {
			return authenticator.Handle(bufConn, conn)
		}
	}

	// failed to authenticate. No supported authentication type found
	conn.Write([]byte{socks5Version, noAcceptable})
	return fmt.Errorf("unknown authentication type")
}

// readMethods is used to read the number and type of methods
func readMethods(r io.Reader) ([]byte, error) {
	header := []byte{0}
	if _, err := r.Read(header); err != nil {
		return nil, err
	}

	numMethods := int(header[0])
	methods := make([]byte, numMethods)
	_, err := io.ReadAtLeast(r, methods, numMethods)
	return methods, err
}

View on GitHub (pinned to 2253eeeb25)

Solutions

1. Configure the server with an authenticator for the method the client offers (e.g. UserPassAuthenticator).
2. Set the client to offer username/password (0x02) or no-auth (0x00) methods the server supports.
3. Check server bootstrap code that authenticators are registered into StandardAuthHandler.
4. Inspect the 0x01 reply byte client-side and adjust the offered method list.

Example fix

// before
authHandler := socks.NewStandardAuthHandler() // no authenticators registered
// after
authHandler := socks.NewStandardAuthHandler()
authHandler.AddAuthenticator(socks.UserPassAuth, socks.NewUserPassAuthenticator(users))

// ensure server advertises methods clients will offer
authHandler.AddAuthenticator(socks.NoAuthAuthMethod, authenticator)

if err := h.authHandler.Handle(bufConn, conn); err != nil {
    if strings.Contains(err.Error(), "unknown authentication type") {
        logger.Info().Msg("client offered no supported auth method")
    }
    return err
}

When it happens

Trigger: The client offers only methods not registered in h.authenticators (e.g. GSSAPI only, while the server supports username/password or no-auth).

Common situations: Client configured to require a stronger auth method than the server supports; server started without username/password authenticators configured; misconfigured proxy clients pointing at the wrong credentials scheme.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Failed to read auth methods: %v
• Unsupported auth version: %v
• User authentication failed
• failed to verify token
• invalid token

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/b85da6741e01875e. Report an issue: GitHub.