jackc/pgx · error

AuthTypeSSPI is unimplemented

Error message

AuthTypeSSPI is unimplemented

What it means

Returned by the authentication dispatcher when the server requests SSPI authentication (auth type 9). SSPI is a Windows-only integrated-auth mechanism; pgx/pgproto3 does not implement it, so the handshake fails. The error is a deliberate non-implementation for non-targeted platforms.

Source

Thrown at pgproto3/frontend.go:445

		return nil, errors.New("authentication message too short")
	}
	f.authType = binary.BigEndian.Uint32(src[:4])

	switch f.authType {
	case AuthTypeOk:
		return &f.authenticationOk, nil
	case AuthTypeCleartextPassword:
		return &f.authenticationCleartextPassword, nil
	case AuthTypeMD5Password:
		return &f.authenticationMD5Password, nil
	case AuthTypeSCMCreds:
		return nil, errors.New("AuthTypeSCMCreds is unimplemented")
	case AuthTypeGSS:
		return &f.authenticationGSS, nil
	case AuthTypeGSSCont:
		return &f.authenticationGSSContinue, nil
	case AuthTypeSSPI:
		return nil, errors.New("AuthTypeSSPI is unimplemented")
	case AuthTypeSASL:
		return &f.authenticationSASL, nil
	case AuthTypeSASLContinue:
		return &f.authenticationSASLContinue, nil
	case AuthTypeSASLFinal:
		return &f.authenticationSASLFinal, nil
	default:
		return nil, fmt.Errorf("unknown authentication type: %d", f.authType)
	}
}

// GetAuthType returns the authType used in the current state of the frontend.
// See SetAuthType for more information.
func (f *Frontend) GetAuthType() uint32 {
	return f.authType
}

func (f *Frontend) ReadBufferLen() int {

View on GitHub (pinned to ec1a0befd2)

Solutions

1. Reconfigure the server's pg_hba.conf to use an auth method pgx supports: scram-sha-256, md5, password, trust, or peer.
2. If SSPI is required organisation-wide, route connections through a proxy/pooler that terminates SSPI upstream and presents scram/md5 to pgx.
3. Verify the pg_hba.conf line matching the client's host/user actually requires the method you intend.
4. Reload PostgreSQL config after editing: `SELECT pg_reload_conf();`.

Example fix

# before — pg_hba.conf on the Windows server
host  all  all  0.0.0.0/0  sspi

# after — use scram-sha-256 over TCP
host  all  all  0.0.0.0/0  scram-sha-256

null

func isUnsupportedAuth(err error) bool {
    return err != nil && (strings.Contains(err.Error(), "AuthTypeSSPI is unimplemented") ||
        strings.Contains(err.Error(), "AuthTypeSCMCreds is unimplemented"))
}

conn, err := pgx.Connect(ctx, connString)
if err != nil && isUnsupportedAuth(err) {
    // Windows SSPI is not implemented in pgx — reconfigure the server.
    log.Printf("SSPI unsupported by pgx; set pg_hba.conf to scram-sha-256/md5/password/trust for this client")
    return err
}

When it happens

Trigger: During the auth handshake, the server sends an Authentication message with type code 9 (AuthTypeSSPI), and findAuthenticationMessageType returns this error. Triggered by a server whose pg_hba.conf specifies `sspi` for the connecting client.

Common situations: Connecting to a Windows PostgreSQL server configured for SSPI integrated auth from a non-Windows client (or any client using pgx). Cross-platform tools that assume SSPI will work everywhere hit this on Linux/macOS.

Related errors

• AuthTypeSCMCreds is unimplemented
• bad authentication message size
• bad authentication message size
• bad authentication message size
• authentication message too short

AI-assisted analysis of jackc/pgx@ec1a0befd2 (2026-08-04). Data as JSON: /data/errors/950b0417353c00e5.json. Report an issue: GitHub.