cube-js/cube · error · Error

SASL Failed with status ${status}: ${payload.toString('utf-8

Error message

SASL Failed with status ${status}: ${payload.toString('utf-8')}

What it means

TSaslTransport's receiver callback performs the SASL handshake for the Thrift transport used to talk to Hive. receiveSaslMessage() parses the server's SASL status and payload; if the status is not COMPLETE (e.g. BAD or FAIL), the server rejected authentication and the negotiated server message is included in the thrown error.

Source

Thrown at packages/cubejs-hive-driver/src/TSaslTransport.js:94

            TSaslTransport.sendSaslMessage(OK, Buffer.from(payload, 'utf-8'), callback);
          }
        } else {
          sendFrame(data, seqId, callback);
        }
      });
    }

    static receiver(callback, seqid) {
      const receiver = thrift.TBufferedTransport.receiver(callback, seqid);

      let frame = null;

      return (data) => {
        if (!saslComplete) {
          thrift.TBufferedTransport.receiver((transport) => {
            const { status, payload } = TSaslTransport.receiveSaslMessage(transport);
            if (status !== COMPLETE) {
              throw new Error(`SASL Failed with status ${status}: ${payload.toString('utf-8')}`);
            }
            saslComplete = true;
            flushPendingData();
          })(data);
        } else {
          if (!frame) {
            frame = new Frame();
          }
          const frames = frame.read(data, 0);

          frames.filter(f => f.fullyRead).map(f => receiver(f.buffer));
          frame = frames.find(f => !f.fullyRead);
        }
      };
    }

    static sendSaslMessage(status, payload, callback) {
      const saslTransport = new thrift.TBufferedTransport(null, callback);

View on GitHub (pinned to 7d981676b3)

Solutions

1. Verify CUBEJS_DB_USER/CUBEJS_DB_PASSWORD match the credentials Hive expects for its configured auth mechanism.
2. Match the SASL mechanism: if Hive uses Kerberos, configure Kerberos (principal/keytab) rather than PLAIN username/password.
3. Check the payload in the error message — it usually contains Hive's own auth failure reason (e.g. 'Error validating LDAP user').
4. Confirm HiveServer2 auth settings in hive-site.xml (hive.server2.authentication) align with the driver config.

Example fix

// before (.env)
CUBEJS_DB_USER=hive
CUBEJS_DB_PASS=wrongpass
// after
CUBEJS_DB_USER=hive
CUBEJS_DB_PASS=correct_password
# or, for Kerberos clusters, supply principal/keytab config instead of PLAIN credentials

if (!process.env.CUBEJS_DB_USER || !process.env.CUBEJS_DB_PASS) {
  throw new Error('Hive credentials required for SASL authentication');
}

function isSaslAuthError(e) {
  return e instanceof Error && /^SASL Failed with status/.test(e.message);
}

try {
  await hiveDriver.query(sql);
} catch (e) {
  if (/^SASL Failed with status/.test(e.message || '')) {
    console.error('Hive SASL auth failed — check credentials/mechanism:', e.message);
    // do not retry blindly; auth failures are not transient
    throw e;
  }
  throw e;
}

When it happens

Trigger: Opening a Hive connection where the SASL handshake response status is not COMPLETE — wrong username/password, server configured for a different SASL mechanism (e.g. DIGEST-MD5 vs PLAIN), Kerberos vs LDAP mismatch, or the server sending a malformed/short SASL frame that yields an unexpected status.

Common situations: HiveServer2 with LDAP auth and wrong CUBEJS_DB_USER/PASS; cluster configured for Kerberos/GSSAPI while the client uses PLAIN; Hive behind a proxy mangling the negotiated frames; mixed Hive versions negotiating incompatible mechanisms.

Related errors

• Incorrect payload size in SASL message: ${payloadSize}
• SASL Error: ${payload.toString('utf-8')}
• Failed to get access token: ${res.statusText}
• Can't fetch metrics from Dbt Cloud: ${res.errors[0].message}
• ${response.status === 401 ? 'Unauthorized request' : 'Unexpe

AI-assisted analysis of cube-js/cube@7d981676b3 (2026-09-02). Data as JSON: /api/errors/56c19c588e81a080. Report an issue: GitHub.