{"id":"c4a04995a84e68cf","repo":"mongodb/node-mongodb-native","slug":"no-authprovider-for-resolvedcredentials-mechanis","errorCode":null,"errorMessage":"No AuthProvider for ${resolvedCredentials.mechanism} defined.","messagePattern":"No AuthProvider for (.+?) defined\\.","errorType":"exception","errorClass":"MongoInvalidArgumentError","httpStatus":null,"severity":"error","filePath":"src/cmap/connect.ts","lineNumber":165,"sourceCode":"  }\n\n  // NOTE: This is metadata attached to the connection while porting away from\n  //       handshake being done in the `Server` class. Likely, it should be\n  //       relocated, or at very least restructured.\n  conn.hello = response;\n  conn.lastHelloMS = new Date().getTime() - start;\n\n  if (!response.arbiterOnly && credentials) {\n    // store the response on auth context\n    authContext.response = response;\n\n    const resolvedCredentials = credentials.resolveAuthMechanism(response);\n    const provider = options.authProviders.getOrCreateProvider(\n      resolvedCredentials.mechanism,\n      resolvedCredentials.mechanismProperties\n    );\n    if (!provider) {\n      throw new MongoInvalidArgumentError(\n        `No AuthProvider for ${resolvedCredentials.mechanism} defined.`\n      );\n    }\n\n    try {\n      await provider.auth(authContext);\n    } catch (error) {\n      // NOTE: If we encounter an error authenticating a connection, do NOT apply backpressure labels.\n\n      if (error instanceof MongoError) {\n        error.addErrorLabel(MongoErrorLabel.HandshakeError);\n        if (needsRetryableWriteLabel(error)) {\n          error.addErrorLabel(MongoErrorLabel.RetryableWriteError);\n        }\n      }\n\n      throw error;\n    }","sourceCodeStart":147,"sourceCodeEnd":183,"githubUrl":"https://github.com/mongodb/node-mongodb-native/blob/3366c21a6311e02f1be91da982f9b93d3cce99a0/src/cmap/connect.ts#L147-L183","documentation":"Thrown after the handshake completes, when credentials.resolveAuthMechanism(response) returned a concrete mechanism (e.g. the server advertised SCRAM-SHA-256 and the credentials were 'MONGODB-CR' default) but AuthProviders.getOrCreateProvider() returned undefined for that resolved mechanism. This means the driver's auth provider registry does not recognize the resolved mechanism - effectively a misregistered or stripped-down build.","triggerScenarios":"Inside performInitialHandshake (src/cmap/connect.ts:159-168) on a non-arbiter connection that has credentials. The default mechanism resolves to SCRAM-SHA-256/SCRAM-SHA-1 normally; this fires only if a custom AuthProviders was injected (via MongoClientOptions.authProviders) that lacks the resolved mechanism, or if a custom mechanism plugin failed to register.","commonSituations":"Passing a custom authProviders option that does not include the standard SCRAM providers; monkeypatching the driver to remove a provider; running against a forked/patched driver build where provider registration was stripped; using a third-party auth plugin that doesn't register for the mechanism the server negotiated.","solutions":["Stop passing a custom authProviders option unless you explicitly need a custom mechanism, so the default registry (which includes SCRAM-SHA-256, SCRAM-SHA-1, X509, etc.) is used.","If you do customize authProviders, ensure you include the built-in providers (import and re-register X509/MongoDBAWS/Plain/ScramSha256/ScramSha1/OIDC/GSSAPI as needed).","Check the server's saslSupportedMechs advertisement in the hello response and ensure your custom registry covers the negotiated mechanism.","Upgrade the driver; older builds had partial provider coverage."],"exampleFix":"// before\nconst client = new MongoClient(uri, { authProviders: new AuthProviders({ /* only custom */ }) });\n\n// after\nconst client = new MongoClient(uri); // default registry includes SCRAM providers","handlingStrategy":"validation","validationCode":"import { AuthMechanism } from 'mongodb';\nfunction assertRegistryHasResolved(registry: any, resolvedMech: string) {\n  if (!registry.getOrCreateProvider(resolvedMech)) {\n    throw new Error(`authProviders registry missing ${resolvedMech}`);\n  }\n}","typeGuard":"function hasAllScramProviders(authProviders: any): boolean {\n  return Boolean(authProviders?.getOrCreateProvider('SCRAM-SHA-256')) &&\n    Boolean(authProviders?.getOrCreateProvider('SCRAM-SHA-1'));\n}","tryCatchPattern":"import { MongoInvalidArgumentError } from 'mongodb';\ntry {\n  await client.connect();\n} catch (e) {\n  if (e instanceof MongoInvalidArgumentError && /No AuthProvider/.test(e.message)) {\n    // remove custom authProviders option and recreate client\n  }\n  throw e;\n}","preventionTips":["Do not pass a custom authProviders option unless strictly necessary.","If customizing, spread the default registry and only add/override specific mechanisms.","Unit-test that your custom registry resolves every mechanism your deployment may negotiate."],"tags":["auth","auth-provider","configuration","handshake"],"analyzedSha":"3366c21a6311e02f1be91da982f9b93d3cce99a0","analyzedAt":"2026-08-04T13:40:15.335Z","schemaVersion":2}