cube-js/cube · error · Error

SASL Error: ${payload.toString('utf-8')}

Error message

SASL Error: ${payload.toString('utf-8')}

What it means

After reading a SASL frame in TSaslTransport.receiveSaslMessage, if the status byte is BAD or ERROR the driver throws an Error whose message is 'SASL Error: ' plus the UTF-8 payload the server returned. The payload text comes from the server, so this is the server rejecting the SASL negotiation (auth failure, unsupported mechanism, etc.).

Source

Thrown at packages/cubejs-hive-driver/src/TSaslTransport.js:130

      const saslTransport = new thrift.TBufferedTransport(null, callback);
      const messageHeader = Buffer.alloc(5);
      messageHeader.writeInt8(status);
      messageHeader.writeUInt32BE(payload.length, 1);
      saslTransport.write(messageHeader);
      saslTransport.write(payload);
      saslTransport.flush();
    }

    static receiveSaslMessage(transport) {
      const buffer = transport.read(5);
      const status = buffer.readInt8();
      const payloadSize = buffer.readUInt32BE(1);
      if (payloadSize < 0 || payloadSize > 104857600) {
        throw new Error(`Incorrect payload size in SASL message: ${payloadSize}`);
      }
      const payload = transport.read(payloadSize);
      if (status === BAD || status === ERROR) {
        throw new Error(`SASL Error: ${payload.toString('utf-8')}`);
      }
      return { status, payload };
    }
  }

  return TSaslTransport;
};

View on GitHub (pinned to 7d981676b3)

Solutions

1. Read the server-provided payload text after 'SASL Error:' — it names the actual reason
2. Verify username/password credentials for the Hive/Impala endpoint
3. Confirm the server's authentication mechanism (NONE/PLAIN/LDAP/KERBEROS) and configure the driver to match
4. Enable client-side SASL debugging/logging to inspect the negotiation steps

Example fix

// before: wrong mechanism for the cluster
new HiveDriver({ username: 'user', password: 'pass' }); // server requires Kerberos
// after: use a Kerberos-capable configuration or enable matching auth on server
new HiveDriver({ username: 'user', kerberos: true /* plus keytab/principal */, ... });

// Validate credentials/mechanism before connecting
if (!process.env.CUBEJS_DB_USER || !process.env.CUBEJS_DB_PASS) {
  throw new Error('Hive credentials missing: SASL negotiation will fail');
}

try {
  await driver.testConnection();
} catch (e) {
  if (String(e.message).startsWith('SASL Error:')) {
    const serverReason = e.message.slice('SASL Error:'.length).trim();
    console.error('Server rejected SASL negotiation:', serverReason);
    // route to credential/mechanism fix
  } else throw e;
}

When it happens

Trigger: During SASL handshake, server replies with status BAD or ERROR — e.g. wrong username/password for PLAIN auth, server not configured for the offered mechanism, or server policy rejecting the client.

Common situations: Wrong CUBEJS_DB_USER/CUBEJS_DB_PASS credentials against Hive with LDAP/Kerberos/plain auth; cluster requiring Kerberos while driver performs PLAIN; auth mechanism disabled on the server.

Related errors

• SASL Failed with status ${status}: ${payload.toString('utf-8
• Incorrect payload size in SASL message: ${payloadSize}
• options.checkAuth must be a function
• Provided token isn't for ${dotCubeCloud.url}
• JSON.stringify(deployments)

AI-assisted analysis of cube-js/cube@7d981676b3 (2026-09-02). Data as JSON: /api/errors/59a28e9723dac3f9. Report an issue: GitHub.