t8y2/dbx · error

authenticate to ZooKeeper: %w

Error message

authenticate to ZooKeeper: %w

What it means

This error wraps connection.AddAuth failures when authenticating the ZooKeeper session (discovery.go:117). It fires when an auth scheme/credentials are configured (e.g. digest SASL) and AddAuth rejects the scheme or credentials. Misconfiguration where only one of scheme or credentials is set produces a distinct error before this point.

Source

Thrown at agents/drivers/hive-go/discovery.go:117

	}
	timeout := discovery.timeout
	if timeout <= 0 {
		timeout = defaultConnectTimeout
	}
	connection, events, err := discovery.dialer(addresses, timeout)
	if err != nil {
		return nil, fmt.Errorf("connect to ZooKeeper: %w", err)
	}
	defer connection.Close()
	if err := waitForZooKeeperSession(ctx, events, timeout); err != nil {
		return nil, err
	}
	if discovery.authScheme != "" || discovery.auth != "" {
		if discovery.authScheme == "" || discovery.auth == "" {
			return nil, errors.New("ZooKeeper auth scheme and credentials must be configured together")
		}
		if err := connection.AddAuth(discovery.authScheme, []byte(discovery.auth)); err != nil {
			return nil, fmt.Errorf("authenticate to ZooKeeper: %w", err)
		}
	}
	resolved := make([]endpoint, 0)
	var listedPath string
	var nodeFailures []string
	for _, path := range discovery.paths() {
		children, _, childrenErr := connection.Children(path)
		if errors.Is(childrenErr, zk.ErrNoNode) {
			continue
		}
		if childrenErr != nil {
			return nil, fmt.Errorf("list ZooKeeper namespace %s: %w", path, childrenErr)
		}
		listedPath = path
		for _, child := range children {
			data, _, dataErr := connection.Get(path + "/" + child)
			if dataErr != nil {
				if errors.Is(dataErr, zk.ErrNoNode) {

View on GitHub (pinned to c0390bff16)

Solutions

1. Verify the auth scheme (e.g. digest) and credentials are both correct and formatted as expected (user:password for digest).
2. Confirm the credentials match the ACLs on the HiveServer2 znodes.
3. Check the ZooKeeper server logs for the rejection reason.
4. Remove the auth parameters if the znodes do not require authentication.

Example fix

// before
params["zookeeperauth"] = "digest"
params["zookeeperauthdata"] = "svcuser" // missing password part
// after
params["zookeeperauth"] = "digest"
params["zookeeperauthdata"] = "svcuser:svcsecret"

scheme, auth := params["zookeeperauth"], params["zookeeperauthdata"]
if (scheme != "") != (auth != "") {
    return errors.New("zookeeper auth scheme and credentials must both be set")
}
if scheme == "digest" && !strings.Contains(auth, ":") {
    return errors.New("digest auth must be user:password")
}

When it happens

Trigger: discovery.authScheme or discovery.auth is non-empty, both are set (pair validated), and connection.AddAuth(scheme, []byte(auth)) returns an error: invalid scheme, malformed credentials, or session state issues.

Common situations: Digest ACL-protected HiveServer2 znodes where the digest secret is wrong or misformatted (user:password); ZooKeeper SASL configuration copied incompletely from JDBC settings; scheme typo (e.g. 'digest' misspelled).

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• ZooKeeper session closed because SASL authentication is requ
• ZooKeeper SASL round %d: %w
• continue ZooKeeper GSSAPI negotiation at round %d: %w
• Hive JWT authentication requires jwt or the JWT environment
• Hive delegation token authentication requires delegationToke

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/274058babba7e581. Report an issue: GitHub.