server method doesn't support Extended Identity Header (EIH)

Error message

server method doesn't support Extended Identity Header (EIH), remove `users`

What it means

This error is raised during server config validation in crates/shadowsocks-service/src/config.rs when a server is configured with a `users` list (EUI/EIH users) but the chosen cipher method does not support Extended Identity Header (EIH). EIH is only supported by AEAD-2022 ciphers; pairing users with e.g. aes-256-gcm makes the multi-user identity mechanism impossible, so validation fails fast at config load.

Source

Thrown at crates/shadowsocks-service/src/config.rs:2973

                ServerAddr::DomainName(dn, port) => {
                    if dn.is_empty() || *port == 0 {
                        let err = Error::new(
                            ErrorKind::Malformed,
                            "`server` shouldn't be an empty string, `server_port` shouldn't be 0",
                            None,
                        );
                        return Err(err);
                    }
                }
            }

            // Users' key must match key length
            if let Some(user_manager) = server.user_manager() {
                #[cfg(feature = "aead-cipher-2022")]
                if server.method().is_aead_2022() {
                    use shadowsocks::config::method_support_eih;
                    if user_manager.user_count() > 0 && !method_support_eih(server.method()) {
                        let err = Error::new(
                            ErrorKind::Invalid,
                            "server method doesn't support Extended Identity Header (EIH), remove `users`",
                            Some(format!("method {}", server.method())),
                        );
                        return Err(err);
                    }
                }

                let key_len = server.method().key_len();
                for user in user_manager.users_iter() {
                    if user.key().len() != key_len {
                        let err = Error::new(
                            ErrorKind::Malformed,
                            "`users[].password` length must be exactly the same as method's key length",
                            None,
                        );
                        return Err(err);
                    }

View on GitHub (pinned to 8eb0f0a65b)

Solutions

Change the server method to an AEAD-2022 cipher that supports EIH, e.g. 2022-blake3-aes-128-gcm, 2022-blake3-aes-256-gcm, or 2022-blake3-chacha20-poly1305
Remove the `users` array from the server config if multi-user EUI support is not needed
Ensure every user password/base64 key length matches the method's key length (also required for AEAD-2022)

Example fix

// before
{"method":"aes-256-gcm","users":[{"password":"<key>"}]}
// after
{"method":"2022-blake3-aes-256-gcm","users":[{"password":"<base64-key-same-length>"}]}

Defensive patterns

Strategy: validation

Validate before calling

fn supports_eih(method: &str) -> bool {
    matches!(method, "2022-blake3-aes-128-gcm" | "2022-blake3-aes-256-gcm" | "2022-blake3-chacha20-poly1305")
}
// before load: assert!(users.is_empty() || supports_eih(&server.method));

Type guard

fn is_eih_capable(method: &ServerConfigMethod) -> bool {
    shadowsocks::config::method_support_eih(method)
}

Try / catch

match config.validate() {
    Err(e) if e.to_string().contains("Extended Identity Header") => eprintln!("remove `users` or switch to an AEAD-2022 method: {e}"),
    Err(e) => return Err(e),
    Ok(v) => v,
}

Prevention

Only combine `users` with AEAD-2022 (2022-blake3-*) methods
Centralize method/user validation in one config-check function
Pin method and users in the same config template so they can't drift

When it happens

Trigger: Building a ServerConfig via Config::from_str/from_url (or loading a JSON config) where `servers[].users` is non-empty and the `method` is not an AEAD-2022 cipher (method_support_eih() returns false).

Common situations: Copy-pasting a multi-user config from an AEAD-2022 example but leaving the method as aes-256-gcm or chacha20-ietf-poly1305; enabling EUI users after switching methods down; tooling that appends users without checking the cipher.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

AI-assisted analysis of shadowsocks/shadowsocks-rust@8eb0f0a65b (2026-09-09). Data as JSON: /api/errors/4c26f35bec06c679. Report an issue: GitHub.