juicedata/juicefs · error

Auth: %s

Error message

Auth: %s

What it means

newSwiftOSS wraps any failure from the swift library's conn.Authenticate() with the prefix "Auth: ". It means the OpenStack Swift credentials/endpoint were rejected or unreachable during the initial authentication handshake, so no swiftOSS client can be constructed.

Source

Thrown at pkg/object/swift.go:159

		return nil, fmt.Errorf("Invalid host: %s", uri.Host)
	}
	container := hostSlice[0]
	host := hostSlice[1]

	// current only support V1 authentication
	authURL := uri.Scheme + "://" + host + "/auth/v1.0"

	conn := swift.Connection{
		UserName:  username,
		ApiKey:    apiKey,
		AuthToken: token,
		AuthUrl:   authURL,
		UserAgent: UserAgent,
		Transport: httpClient.Transport.(*http.Transport),
	}
	err = conn.Authenticate(context.Background())
	if err != nil {
		return nil, fmt.Errorf("Auth: %s", err)
	}
	return &swiftOSS{DefaultObjectStorage{}, &conn, conn.Region, conn.StorageUrl, container}, nil
}

func init() {
	Register("swift", newSwiftOSS)
}

View on GitHub (pinned to c9a67b23e8)

Solutions

1. Verify auth URL, username, password, tenant/project (and domain for v3) in the swift connection string
2. Test authentication against the same Keystone endpoint with curl or the openstack CLI
3. Check network reachability/DNS/TLS to the auth URL from the client host
4. Ensure the swift library auth version (v1/v2/v3) matches the server

Example fix

// before
storage = "swift"
metaurl = "..."
// swift URL missing project: swift://container/authURL/user/pass
// after
// full swift URL with tenant/project: swift://container/https://auth.example.com/v3/user/pass/project

func validSwiftAuth(u *url.URL) error {
	if u.Scheme != "swift" { return fmt.Errorf("scheme must be swift, got %s", u.Scheme) }
	parts := strings.SplitN(strings.TrimPrefix(u.Opaque, "//"), "/", 4)
	if len(parts) < 4 { return errors.New("swift URL needs container/authURL/user/pass") }
	if !strings.HasPrefix(parts[1], "http") { return errors.New("auth URL missing scheme") }
	return nil
}

_, err := object.CreateStorage(ctx, "swift", url, "", "")
if err != nil && strings.HasPrefix(err.Error(), "Auth:") {
	// inspect credentials/keystone before retrying
}

When it happens

Trigger: juicefs format/mount with a swift:// URL where Authenticate() fails: wrong username/password/domain, bad auth URL, missing or wrong tenant/project name, unreachable Keystone server, or expired token.

Common situations: Misconfigured SWIFT credentials in storage config; OpenStack Keystone endpoint behind firewall; using v2 auth API against a server that only supports v3 (or vice versa); project/tenant name omitted when required.

Related errors

• create B2 client: %s
• SMB authentication failed: %v
• Problem with kerberos authentication: %s
• No kerberos credential was found! Parameter "--keytab" and "
• ceph: can't put empty file

AI-assisted analysis of juicedata/juicefs@c9a67b23e8 (2026-09-06). Data as JSON: /api/errors/470457fef20ba8e7. Report an issue: GitHub.