jaegertracing/jaeger · error

authenticator is not supported

Error message

authenticator is not supported

What it means

This error is raised by initializeConnections in the gRPC storage v2 factory when the configuration sets an authenticator (config.Auth.HasValue()). The gRPC remote-storage client does not support authentication plugins in this code path, so NewFactory refuses to start with a clear message instead of silently ignoring the auth settings.

Source

Thrown at internal/storage/v2/grpc/factory.go:122

	telset telemetry.Settings,
	tracerProvider trace.TracerProvider,
) component.TelemetrySettings {
	return component.TelemetrySettings{
		Logger:         telset.Logger,
		TracerProvider: tracerProvider,
		MeterProvider:  telset.MeterProvider,
	}
}

type newClientFn func(telset component.TelemetrySettings, gcs *configgrpc.ClientConfig, opts ...grpc.DialOption) (*grpc.ClientConn, error)

func (f *Factory) initializeConnections(
	readerTelset, writerTelset component.TelemetrySettings,
	readerConfig, writerConfig *configgrpc.ClientConfig,
	newClient newClientFn,
) error {
	if f.config.Auth.HasValue() {
		return errors.New("authenticator is not supported")
	}
	const maxRecvMsgSizeMiB = math.MaxInt / (1024 * 1024)
	if f.config.MaxRecvMsgSizeMiB < 0 || f.config.MaxRecvMsgSizeMiB > maxRecvMsgSizeMiB {
		return fmt.Errorf("max_recv_msg_size_mib must be between 0 and %d, got %d", maxRecvMsgSizeMiB, f.config.MaxRecvMsgSizeMiB)
	}

	unaryInterceptors := []grpc.UnaryClientInterceptor{bearertoken.NewUnaryClientInterceptor()}
	streamInterceptors := []grpc.StreamClientInterceptor{bearertoken.NewStreamClientInterceptor()}

	if tenancyMgr := tenancy.NewManager(&f.config.Tenancy); tenancyMgr.Enabled {
		unaryInterceptors = append(unaryInterceptors, tenancy.NewClientUnaryInterceptor(tenancyMgr))
		streamInterceptors = append(streamInterceptors, tenancy.NewClientStreamInterceptor(tenancyMgr))
	}

	// HeaderForwarding acts as an enable switch: header capture happens on the query
	// server side (HTTP/gRPC server interceptors); the client interceptors here simply
	// forward whatever was captured into outgoing metadata.
	if len(f.config.HeaderForwarding) > 0 {

View on GitHub (pinned to 806f444784)

Solutions

1. Remove the auth/authenticator block from the gRPC storage client configuration.
2. Authenticate at the network layer instead (mTLS via tls settings, or a sidecar/proxy that terminates auth).
3. Check the version's documentation for supported auth options on the gRPC remote storage client.
4. If authentication is required, use a storage backend whose factory supports authenticators.

Example fix

// before (yaml)
grpc:
  server: jaeger-collector:14250
  auth:
    authenticator: bearer_token_auth
// after
grpc:
  server: jaeger-collector:14250
  tls:
    enabled: true

// Before starting the factory, strip/flag auth settings:
if cfg.Auth.HasValue() {
    return errors.New("grpc storage client does not support authenticators; remove auth block")
}

factory, err := grpcv2.NewFactory(ctx, cfg, telset)
if err != nil && strings.Contains(err.Error(), "authenticator is not supported") {
    // fix config and restart
}

When it happens

Trigger: Starting the Jaeger binary/component with a gRPC remote-storage configuration that includes an auth block (authenticator name) under the storage client config; initializeConnections checks f.config.Auth.HasValue() first and returns this error before dialing.

Common situations: Copying a config file from another storage plugin (e.g. one that supports authenticators) into the gRPC storage section; enabling auth for remote storage after a version change; operators assuming all storage plugins share the same auth support.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• malformed token: multiple tokens found
• invalid gRPC server host:port: %w
• failed to create gRPC server: %w
• max_recv_msg_size_mib must be between 0 and %d, got %d
• error creating reader client connection: %w

AI-assisted analysis of jaegertracing/jaeger@806f444784 (2026-09-01). Data as JSON: /api/errors/7e92f28d853c6eb6. Report an issue: GitHub.