What causes "SMB authentication failed: %v" in juicedata/juicefs?

Verify username, password, and domain in the CIFS endpoint/configuration

SMB authentication failed: %v

Error message

SMB authentication failed: %v

What it means

cifsStore.getConnection dials the SMB server using go-smb2 with the configured credentials. If d.Dial(ctx, address) fails — which includes SMB handshake/authentication (NTLM/Kerberos) rejection — the error is wrapped as "SMB authentication failed".

Source

Thrown at pkg/object/cifs.go:132

CREATE:
	// Create new connection
	// FIXME: may create a large number of connection in a short period, exceeding the limit.
	conn := &cifsConn{}
	conn.lastUsed = now

	// Establish SMB connection
	address := net.JoinHostPort(c.host, c.port)
	d := &smb2.Dialer{
		Initiator: &smb2.NTLMInitiator{
			User:     c.user,
			Password: c.password,
		},
	}

	var err error
	conn.session, err = d.Dial(ctx, address)
	if err != nil {
		return nil, fmt.Errorf("SMB authentication failed: %v", err)
	}

	conn.share, err = conn.session.WithContext(ctx).Mount(c.share)
	if err != nil {
		c.closeConnection(conn)
		return nil, fmt.Errorf("failed to mount SMB share %s: %v", c.share, err)
	}

	return conn, nil
}

func (c *cifsStore) closeConnection(conn *cifsConn) {
	if conn == nil || conn.session == nil {
		return
	}

	session := conn.session
	conn.session = nil

View on GitHub (pinned to c9a67b23e8)

Solutions

Verify username, password, and domain in the CIFS endpoint/configuration
Test credentials with smbclient -L //host -U 'DOMAIN\\user'
Confirm the server supports SMB2/SMB3 (disable SMB1-only requirement) and port 445 is reachable
Check server-side auth policy (NTLMv2 required vs NTLMv1) and account lockout status

Example fix

// before
// endpoint: smb://fileserver/share?username=user&password=wrongpass
// after
// endpoint: smb://fileserver/share?username=DOMAIN%5Cuser&password=correctpass

Defensive patterns

Strategy: try-catch

Validate before calling

// Shell: preflight SMB credentials
smbclient -L //fileserver -U 'DOMAIN\\user' -g >/dev/null || {
  echo "SMB auth failed"; exit 1;
}

Try / catch

// Go
obj, err := object.NewCifs(endpoint)
if err != nil && strings.Contains(err.Error(), "SMB authentication failed") {
    // prompt/rotate credentials; do not retry with same creds
}

Prevention

Keep credentials in a secret store, URL-encode special characters
Confirm the server accepts SMB2/SMB3 and your NTLM version policy
Test auth with smbclient before production rollout

When it happens

Trigger: d.Dial fails because credentials (username/password/domain) are wrong, the SMB port is unreachable, the server requires unsupported SMB dialects, or NTLMv2/NTLMv1 negotiation fails.

Common situations: Wrong --smb-username/--smb-password values; domain prefix mismatch (DOMAIN\\user vs user); server only accepting SMB1 or enforcing encryption the client doesn't offer; network/firewall blocking port 445; account locked out.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of juicedata/juicefs@c9a67b23e8 (2026-09-06). Data as JSON: /api/errors/73abeb0cfc191214. Report an issue: GitHub.