t8y2/dbx · error

continue ZooKeeper GSSAPI negotiation at round %d: %w

Error message

continue ZooKeeper GSSAPI negotiation at round %d: %w

What it means

Returned by protocolZooKeeperClient.authenticateSASL when the GSSAPI client's Step() call fails while processing a ZooKeeper challenge at round N — the Kerberos library rejected the server's token (bad session key, malformed token, principal mismatch). The wrapped error carries the GSSAPI detail.

Source

Thrown at agents/drivers/hive-go/zookeeper_protocol.go:226

			encoder.bytes(token)
		})
		if requestErr != nil {
			return fmt.Errorf("ZooKeeper SASL round %d: %w", round+1, requestErr)
		}
		decoder := newZooKeeperDecoder(response)
		challenge, decodeErr := decoder.bytes()
		if decodeErr != nil {
			return fmt.Errorf("decode ZooKeeper SASL round %d: %w", round+1, decodeErr)
		}
		if saslClient.Complete() {
			if len(challenge) != 0 {
				return errors.New("ZooKeeper sent an unexpected token after GSSAPI completion")
			}
			return nil
		}
		token, err = saslClient.Step(challenge)
		if err != nil {
			return fmt.Errorf("continue ZooKeeper GSSAPI negotiation at round %d: %w", round+1, err)
		}
	}
	return fmt.Errorf("ZooKeeper GSSAPI negotiation exceeded %d rounds", zooKeeperMaxSASLRounds)
}

func (client *protocolZooKeeperClient) AddAuth(scheme string, auth []byte) error {
	_, err := client.request(zooKeeperOpSetAuth, func(encoder *zooKeeperEncoder) {
		encoder.int32(0)
		encoder.string(scheme)
		encoder.bytes(auth)
	})
	return err
}

func (client *protocolZooKeeperClient) Children(path string) ([]string, *zk.Stat, error) {
	response, err := client.request(zooKeeperOpGetChildren2, func(encoder *zooKeeperEncoder) {
		encoder.string(path)
		encoder.boolean(false)

View on GitHub (pinned to c0390bff16)

Solutions

1. Check the wrapped GSSAPI error for the Kerberos cause
2. Ensure agent and ZooKeeper share the same KDC and enctypes
3. Validate the ZooKeeper server's service principal and keytab
4. Re-acquire tickets (kinit) and retry

When it happens

Trigger: Thrown at agents/drivers/hive-go/zookeeper_protocol.go:226 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/4b4f0b3a8aef3718. Report an issue: GitHub.