jaegertracing/jaeger · error

authenticator is not supported

Error message

authenticator is not supported

What it means

This error is raised by initializeConnections in the gRPC storage v2 factory when the configuration sets an authenticator (config.Auth.HasValue()). The gRPC remote-storage client does not support authentication plugins in this code path, so NewFactory refuses to start with a clear message instead of silently ignoring the auth settings.

Solutions

1. Remove the auth/authenticator block from the gRPC storage client configuration.
2. Authenticate at the network layer instead (mTLS via tls settings, or a sidecar/proxy that terminates auth).
3. Check the version's documentation for supported auth options on the gRPC remote storage client.
4. If authentication is required, use a storage backend whose factory supports authenticators.

Example fix

// before (yaml)
grpc:
  server: jaeger-collector:14250
  auth:
    authenticator: bearer_token_auth
// after
grpc:
  server: jaeger-collector:14250
  tls:
    enabled: true

// Before starting the factory, strip/flag auth settings:
if cfg.Auth.HasValue() {
    return errors.New("grpc storage client does not support authenticators; remove auth block")
}

factory, err := grpcv2.NewFactory(ctx, cfg, telset)
if err != nil && strings.Contains(err.Error(), "authenticator is not supported") {
    // fix config and restart
}

When it happens

Trigger: Starting the Jaeger binary/component with a gRPC remote-storage configuration that includes an auth block (authenticator name) under the storage client config; initializeConnections checks f.config.Auth.HasValue() first and returns this error before dialing.

Common situations: Copying a config file from another storage plugin (e.g. one that supports authenticators) into the gRPC storage section; enabling auth for remote storage after a version change; operators assuming all storage plugins share the same auth support.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• error creating reader client connection
• error creating writer client connection
• failed to create gRPC server
• invalid gRPC server host:port
• malformed token: multiple tokens found

AI-assisted analysis of jaegertracing/jaeger@806f444784 (2026-09-01). Data as JSON: /api/errors/7e92f28d853c6eb6. Report an issue: GitHub.

Appendix: source

Thrown at internal/storage/v2/grpc/factory.go:122

	telset telemetry.Settings,
	tracerProvider trace.TracerProvider,
) component.TelemetrySettings {
	return component.TelemetrySettings{
		Logger:         telset.Logger,
		TracerProvider: tracerProvider,
		MeterProvider:  telset.MeterProvider,
	}
}

type newClientFn func(telset component.TelemetrySettings, gcs *configgrpc.ClientConfig, opts ...grpc.DialOption) (*grpc.ClientConn, error)

func (f *Factory) initializeConnections(
	readerTelset, writerTelset component.TelemetrySettings,
	readerConfig, writerConfig *configgrpc.ClientConfig,
	newClient newClientFn,
) error {
	if f.config.Auth.HasValue() {
		return errors.New("authenticator is not supported")
	}
	const maxRecvMsgSizeMiB = math.MaxInt / (1024 * 1024)
	if f.config.MaxRecvMsgSizeMiB < 0 || f.config.MaxRecvMsgSizeMiB > maxRecvMsgSizeMiB {
		return fmt.Errorf("max_recv_msg_size_mib must be between 0 and %d, got %d", maxRecvMsgSizeMiB, f.config.MaxRecvMsgSizeMiB)
	}

	unaryInterceptors := []grpc.UnaryClientInterceptor{bearertoken.NewUnaryClientInterceptor()}
	streamInterceptors := []grpc.StreamClientInterceptor{bearertoken.NewStreamClientInterceptor()}

	if tenancyMgr := tenancy.NewManager(&f.config.Tenancy); tenancyMgr.Enabled {
		unaryInterceptors = append(unaryInterceptors, tenancy.NewClientUnaryInterceptor(tenancyMgr))
		streamInterceptors = append(streamInterceptors, tenancy.NewClientStreamInterceptor(tenancyMgr))
	}

	// HeaderForwarding acts as an enable switch: header capture happens on the query
	// server side (HTTP/gRPC server interceptors); the client interceptors here simply
	// forward whatever was captured into outgoing metadata.
	if len(f.config.HeaderForwarding) > 0 {

View on GitHub (pinned to 806f444784)