microsoft/garnet · critical · Exception

Authentication mode {AuthenticationMode} is not supported.

Error message

Authentication mode {AuthenticationMode} is not supported.

What it means

Thrown by GetAuthenticationSettings when the AuthenticationMode enum value does not match any of the five known cases (NoAuth, Password, Aad, ACL, AclWithAad). This is a configuration validation error during server startup — Garnet refuses to boot with an authentication mode it cannot resolve. The value is typically corrupted by an invalid integer cast or a forward-incompatible enum value from a newer version.

Source

Thrown at libs/host/Configuration/Options.cs:1030

        private IAuthenticationSettings GetAuthenticationSettings(ILogger logger = null)
        {
            switch (AuthenticationMode)
            {
                case GarnetAuthenticationMode.NoAuth:
                    return new NoAuthSettings();
                case GarnetAuthenticationMode.Password:
                    return new PasswordAuthenticationSettings(Password);
                case GarnetAuthenticationMode.Aad:
                    return new AadAuthenticationSettings(AuthorizedAadApplicationIds?.Split(','), AadAudiences?.Split(','), AadIssuers?.Split(','), IssuerSigningTokenProvider.Create(AadAuthority, logger));
                case GarnetAuthenticationMode.ACL:
                    return new AclAuthenticationPasswordSettings(AclFile, Password);
                case GarnetAuthenticationMode.AclWithAad:
                    var aadAuthSettings = new AadAuthenticationSettings(AuthorizedAadApplicationIds?.Split(','), AadAudiences?.Split(','), AadIssuers?.Split(','), IssuerSigningTokenProvider.Create(AadAuthority, logger), AadValidateUsername.GetValueOrDefault());
                    return new AclAuthenticationAadSettings(AclFile, Password, aadAuthSettings);
                default:
                    logger?.LogError("Unsupported authentication mode: {mode}", AuthenticationMode);
                    throw new Exception($"Authentication mode {AuthenticationMode} is not supported.");
            }
        }

        public bool GetFastAofTruncate(ILogger logger = null)
        {
            if (MainMemoryReplication.GetValueOrDefault())
            {
                logger?.LogError("--main-memory-replication is deprecated. Use --fast-aof-truncate instead.");
                return true;
            }
            return FastAofTruncate.GetValueOrDefault();
        }

        /// <summary>
        /// Creates a clone of the current Options object
        /// This method creates a shallow copy of the values of properties decorated with the OptionAttribute
        /// For IEnumerable types it creates a list containing a shallow copy of all the values in the original IEnumerable
        /// </summary>

View on GitHub (pinned to 951b0fc683)

Solutions

Check the AuthenticationMode value in your GarnetServerOptions / config file and ensure it is one of: NoAuth, Password, Aad, ACL, AclWithAad.
If loading config from an older/newer version, align the Garnet version of the config producer with the running server.
If constructing Options in code, validate AuthenticationMode with Enum.IsDefined before passing it to the server.
Inspect the preceding log line 'Unsupported authentication mode: {mode}' which prints the actual invalid value.

Example fix

// before
var opts = new GarnetServerOptions { AuthenticationMode = (GarnetAuthenticationMode)99 };

// after
if (!Enum.IsDefined(typeof(GarnetAuthenticationMode), opts.AuthenticationMode))
    throw new ArgumentOutOfRangeException(nameof(opts.AuthenticationMode), $"Must be one of: {string.Join(", ", Enum.GetNames<GarnetAuthenticationMode>())}");

Defensive patterns

Strategy: validation

Validate before calling

if (!Enum.IsDefined(typeof(GarnetAuthenticationMode), opts.AuthenticationMode))
    throw new ArgumentOutOfRangeException(
        nameof(opts.AuthenticationMode),
        $"Invalid value {opts.AuthenticationMode}. Valid modes: {string.Join(", ", Enum.GetNames<GarnetAuthenticationMode>())}");

Type guard

static bool IsValidAuthMode(GarnetAuthenticationMode mode) =>
    Enum.IsDefined(typeof(GarnetAuthenticationMode), mode);

Prevention

Validate enum values with Enum.IsDefined before assigning to AuthenticationMode.
Never cast arbitrary integers to GarnetAuthenticationMode without validation.
Keep config file producers and the Garnet server on the same version.

When it happens

Trigger: Calling Options.GetAuthenticationSettings with an AuthenticationMode value outside the defined GarnetAuthenticationMode enum range (e.g., (GarnetAuthenticationMode)99). Also triggered if a future enum member is added to GarnetAuthenticationMode without a corresponding case in the switch at Options.cs:1015.

Common situations: Loading a config file or JSON settings object where the AuthenticationMode field contains a raw integer that doesn't map to a valid enum member; deserializing a checkpoint from a newer Garnet version that added an auth mode unknown to the running binary; programmatically constructing Options and assigning an invalid cast.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of microsoft/garnet@951b0fc683 (2026-08-13). Data as JSON: /api/errors/a39b4609106d69e3. Report an issue: GitHub.