{"id":"675834aaeafb4257","repo":"jackc/pgx","slug":"authtypescmcreds-is-unimplemented","errorCode":null,"errorMessage":"AuthTypeSCMCreds is unimplemented","messagePattern":"AuthTypeSCMCreds is unimplemented","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pgproto3/frontend.go","lineNumber":439,"sourceCode":"\tAuthTypeSASLContinue      = 11\n\tAuthTypeSASLFinal         = 12\n)\n\nfunc (f *Frontend) findAuthenticationMessageType(src []byte) (BackendMessage, error) {\n\tif len(src) < 4 {\n\t\treturn nil, errors.New(\"authentication message too short\")\n\t}\n\tf.authType = binary.BigEndian.Uint32(src[:4])\n\n\tswitch f.authType {\n\tcase AuthTypeOk:\n\t\treturn &f.authenticationOk, nil\n\tcase AuthTypeCleartextPassword:\n\t\treturn &f.authenticationCleartextPassword, nil\n\tcase AuthTypeMD5Password:\n\t\treturn &f.authenticationMD5Password, nil\n\tcase AuthTypeSCMCreds:\n\t\treturn nil, errors.New(\"AuthTypeSCMCreds is unimplemented\")\n\tcase AuthTypeGSS:\n\t\treturn &f.authenticationGSS, nil\n\tcase AuthTypeGSSCont:\n\t\treturn &f.authenticationGSSContinue, nil\n\tcase AuthTypeSSPI:\n\t\treturn nil, errors.New(\"AuthTypeSSPI is unimplemented\")\n\tcase AuthTypeSASL:\n\t\treturn &f.authenticationSASL, nil\n\tcase AuthTypeSASLContinue:\n\t\treturn &f.authenticationSASLContinue, nil\n\tcase AuthTypeSASLFinal:\n\t\treturn &f.authenticationSASLFinal, nil\n\tdefault:\n\t\treturn nil, fmt.Errorf(\"unknown authentication type: %d\", f.authType)\n\t}\n}\n\n// GetAuthType returns the authType used in the current state of the frontend.","sourceCodeStart":421,"sourceCodeEnd":457,"githubUrl":"https://github.com/jackc/pgx/blob/ec1a0befd22592cffffdeeb0a50311b506372f4c/pgproto3/frontend.go#L421-L457","documentation":"Returned by the authentication dispatcher when the server requests SCM credential authentication (auth type 6). PostgreSQL supports passing peer credentials via SCM credentials on some BSD sockets, but pgx/pgproto3 does not implement it, so the handshake is aborted. This is an explicit, deliberate non-implementation, not a transient failure.","triggerScenarios":"During connection authentication, the server sends an Authentication message with type code 6 (AuthTypeSCMCreds), and findAuthenticationMessageType returns this error. Triggered by a server configured to demand SCM-credential auth (e.g. some embedded/BSD-only deployments).","commonSituations":"Connecting to a PostgreSQL server (often an embedded variant or a non-standard build) whose pg_hba.conf uses an auth method mapped to SCM credentials. Standard Linux deployments use peer credentials via SO_PEERCRED instead and do not trigger this.","solutions":["Reconfigure the server's pg_hba.conf to use an auth method pgx supports: scram-sha-256, md5, password, trust, or peer (SO_PEERCRED on Linux).","If you cannot change the server, switch to a driver that supports SCM credentials or use a connection pooler that terminates auth upstream.","Verify the auth method in pg_hba.conf matches the connection's host/user/database line.","Restart/reload PostgreSQL after editing pg_hba.conf (`SELECT pg_reload_conf();`)."],"exampleFix":"# before — pg_hba.conf demands SCM creds\n# TYPE  DATABASE  USER  ADDRESS   METHOD\nlocal  all       all             scmcree\n\n# after — use peer (Linux) or scram-sha-256\nlocal  all       all             peer\n# or for TCP:\nhost   all       all   127.0.0.1/32  scram-sha-256","handlingStrategy":"fallback","validationCode":"null","typeGuard":"func isUnsupportedAuth(err error) bool {\n    return err != nil && (strings.Contains(err.Error(), \"AuthTypeSCMCreds is unimplemented\") ||\n        strings.Contains(err.Error(), \"AuthTypeSSPI is unimplemented\"))\n}","tryCatchPattern":"conn, err := pgx.Connect(ctx, connString)\nif err != nil && isUnsupportedAuth(err) {\n    // server demands an auth method pgx cannot satisfy — must reconfigure the server,\n    // there is no in-process workaround.\n    log.Printf(\"unsupported auth method; reconfigure pg_hba.conf to scram-sha-256/md5/password/trust/peer\")\n    return err\n}","preventionTips":["Audit pg_hba.conf before deploying clients that use pgx; ensure the matching line uses scram-sha-256, md5, password, trust, or peer (Linux).","Document server auth requirements in the project so clients pick supported methods.","If SCM creds are mandatory, front the server with a pooler that terminates auth upstream."],"tags":["pgproto3","authentication","unsupported","configuration","connection"],"analyzedSha":"ec1a0befd22592cffffdeeb0a50311b506372f4c","analyzedAt":"2026-08-04T22:52:11.263Z","schemaVersion":2}