jackc/pgx · error

AuthTypeSCMCreds is unimplemented

Error message

AuthTypeSCMCreds is unimplemented

What it means

Returned by the authentication dispatcher when the server requests SCM credential authentication (auth type 6). PostgreSQL supports passing peer credentials via SCM credentials on some BSD sockets, but pgx/pgproto3 does not implement it, so the handshake is aborted. This is an explicit, deliberate non-implementation, not a transient failure.

Source

Thrown at pgproto3/frontend.go:439

	AuthTypeSASLContinue      = 11
	AuthTypeSASLFinal         = 12
)

func (f *Frontend) findAuthenticationMessageType(src []byte) (BackendMessage, error) {
	if len(src) < 4 {
		return nil, errors.New("authentication message too short")
	}
	f.authType = binary.BigEndian.Uint32(src[:4])

	switch f.authType {
	case AuthTypeOk:
		return &f.authenticationOk, nil
	case AuthTypeCleartextPassword:
		return &f.authenticationCleartextPassword, nil
	case AuthTypeMD5Password:
		return &f.authenticationMD5Password, nil
	case AuthTypeSCMCreds:
		return nil, errors.New("AuthTypeSCMCreds is unimplemented")
	case AuthTypeGSS:
		return &f.authenticationGSS, nil
	case AuthTypeGSSCont:
		return &f.authenticationGSSContinue, nil
	case AuthTypeSSPI:
		return nil, errors.New("AuthTypeSSPI is unimplemented")
	case AuthTypeSASL:
		return &f.authenticationSASL, nil
	case AuthTypeSASLContinue:
		return &f.authenticationSASLContinue, nil
	case AuthTypeSASLFinal:
		return &f.authenticationSASLFinal, nil
	default:
		return nil, fmt.Errorf("unknown authentication type: %d", f.authType)
	}
}

// GetAuthType returns the authType used in the current state of the frontend.

View on GitHub (pinned to ec1a0befd2)

Solutions

1. Reconfigure the server's pg_hba.conf to use an auth method pgx supports: scram-sha-256, md5, password, trust, or peer (SO_PEERCRED on Linux).
2. If you cannot change the server, switch to a driver that supports SCM credentials or use a connection pooler that terminates auth upstream.
3. Verify the auth method in pg_hba.conf matches the connection's host/user/database line.
4. Restart/reload PostgreSQL after editing pg_hba.conf (`SELECT pg_reload_conf();`).

Example fix

# before — pg_hba.conf demands SCM creds
# TYPE  DATABASE  USER  ADDRESS   METHOD
local  all       all             scmcree

# after — use peer (Linux) or scram-sha-256
local  all       all             peer
# or for TCP:
host   all       all   127.0.0.1/32  scram-sha-256

null

func isUnsupportedAuth(err error) bool {
    return err != nil && (strings.Contains(err.Error(), "AuthTypeSCMCreds is unimplemented") ||
        strings.Contains(err.Error(), "AuthTypeSSPI is unimplemented"))
}

conn, err := pgx.Connect(ctx, connString)
if err != nil && isUnsupportedAuth(err) {
    // server demands an auth method pgx cannot satisfy — must reconfigure the server,
    // there is no in-process workaround.
    log.Printf("unsupported auth method; reconfigure pg_hba.conf to scram-sha-256/md5/password/trust/peer")
    return err
}

When it happens

Trigger: During connection authentication, the server sends an Authentication message with type code 6 (AuthTypeSCMCreds), and findAuthenticationMessageType returns this error. Triggered by a server configured to demand SCM-credential auth (e.g. some embedded/BSD-only deployments).

Common situations: Connecting to a PostgreSQL server (often an embedded variant or a non-standard build) whose pg_hba.conf uses an auth method mapped to SCM credentials. Standard Linux deployments use peer credentials via SO_PEERCRED instead and do not trigger this.

Related errors

• AuthTypeSSPI is unimplemented
• bad authentication message size
• bad authentication message size
• bad authentication message size
• authentication message too short

AI-assisted analysis of jackc/pgx@ec1a0befd2 (2026-08-04). Data as JSON: /data/errors/675834aaeafb4257.json. Report an issue: GitHub.