t8y2/dbx · error

password is required when auth_scheme = "sasl_digest"

Error message

password is required when auth_scheme = "sasl_digest"

What it means

Returned by openClient in the zookeeper driver when auth_scheme is sasl_digest but the password configuration is empty. SASL DIGEST-MD5 authentication requires both username and password; this guard fires during connect/test_connection after the username check, before any ZooKeeper connection is attempted.

Source

Thrown at agents/drivers/zookeeper/connection.go:162

		result["databaseInfo"] = info
	}
	return result, nil
}

func openClient(config connectionConfig) (*clientSession, error) {
	if hasTLSOptions(config) {
		return nil, errors.New("ZooKeeper TLS is not supported")
	}
	authScheme := resolveAuthScheme(config)
	if authScheme != defaultAuthScheme && authScheme != saslDigestAuthScheme {
		return nil, fmt.Errorf("Unsupported auth_scheme %q; expected %q or %q", authScheme, defaultAuthScheme, saslDigestAuthScheme)
	}
	if authScheme == saslDigestAuthScheme {
		if strings.TrimSpace(config.Username) == "" {
			return nil, errors.New(`username is required when auth_scheme = "sasl_digest"`)
		}
		if config.Password == "" {
			return nil, errors.New(`password is required when auth_scheme = "sasl_digest"`)
		}
	}
	if config.BaseSleepTimeMS != nil && *config.BaseSleepTimeMS < 0 {
		return nil, errors.New("base_sleep_time_ms must be non-negative")
	}
	if config.MaxRetries != nil && *config.MaxRetries < 0 {
		return nil, errors.New("max_retries must be non-negative")
	}
	maxBufferSize, err := resolveMaxBufferSize(config)
	if err != nil {
		return nil, err
	}

	target, err := parseConnectTarget(connectionString(config))
	if err != nil {
		return nil, err
	}
	connectionTimeout := millisecondsOrDefault(config.ConnectionTimeoutMS, defaultConnectionTimeout)

View on GitHub (pinned to c0390bff16)

Solutions

1. Set the password in the connection config when using sasl_digest
2. Verify the secret/env source resolves to a non-empty value before connecting
3. Use the default auth scheme if anonymous/no-auth access is intended
4. Check ZooKeeper server logs afterward to confirm the SASL handshake succeeds

Example fix

// before
cfg := connectionConfig{AuthScheme: "sasl_digest", Username: "zkuser"} // password empty
// after
cfg := connectionConfig{AuthScheme: "sasl_digest", Username: "zkuser", Password: os.Getenv("ZK_PASSWORD")}

if cfg.AuthScheme == "sasl_digest" && cfg.Password == "" {
    return errors.New("password is required when auth_scheme = sasl_digest")
}

_, err := openClient(cfg)
if err != nil && strings.Contains(err.Error(), "password is required") {
    return fmt.Errorf("check secret injection for ZK password: %w", err)
}

When it happens

Trigger: connectionConfig has auth_scheme = "sasl_digest", Username is set, but Password is an empty string at connection time.

Common situations: Password stored in an env var or secret that is unset/empty in the environment; config template with password left as placeholder removed; interactive prompt skipped in CI.

Related errors

• username is required when auth_scheme = "sasl_digest"
• ZooKeeper auth scheme and credentials must be configured tog
• ZooKeeper session closed because SASL authentication is requ
• ZooKeeper Kerberos SASL requires Hive Kerberos credentials
• ZooKeeper authentication failed

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/c969a2271bbaea36. Report an issue: GitHub.