t8y2/dbx · error
Unsupported auth_scheme %q; expected %q or %q
Error message
Unsupported auth_scheme %q; expected %q or %q
What it means
openClient validates auth_scheme after resolving it; only the default scheme and sasl_digest are supported. Any other value produces this formatted error naming the rejected scheme and the two accepted values.
Source
Thrown at agents/drivers/zookeeper/connection.go:154
}
func (service *server) connectionInfo() (map[string]any, error) {
if _, err := service.requireClient(); err != nil {
return nil, err
}
result := map[string]any{}
if info := databaseInfo(service.activeConfig); info != nil {
result["databaseInfo"] = info
}
return result, nil
}
func openClient(config connectionConfig) (*clientSession, error) {
if hasTLSOptions(config) {
return nil, errors.New("ZooKeeper TLS is not supported")
}
authScheme := resolveAuthScheme(config)
if authScheme != defaultAuthScheme && authScheme != saslDigestAuthScheme {
return nil, fmt.Errorf("Unsupported auth_scheme %q; expected %q or %q", authScheme, defaultAuthScheme, saslDigestAuthScheme)
}
if authScheme == saslDigestAuthScheme {
if strings.TrimSpace(config.Username) == "" {
return nil, errors.New(`username is required when auth_scheme = "sasl_digest"`)
}
if config.Password == "" {
return nil, errors.New(`password is required when auth_scheme = "sasl_digest"`)
}
}
if config.BaseSleepTimeMS != nil && *config.BaseSleepTimeMS < 0 {
return nil, errors.New("base_sleep_time_ms must be non-negative")
}
if config.MaxRetries != nil && *config.MaxRetries < 0 {
return nil, errors.New("max_retries must be non-negative")
}
maxBufferSize, err := resolveMaxBufferSize(config)
if err != nil {View on GitHub (pinned to c0390bff16)
Solutions
- Set auth_scheme to the default scheme or exactly "sasl_digest"
- Fix typos/spacing/case in the auth_scheme value
- Remove auth_scheme entirely to use the default scheme
- Verify the scheme against the driver's supported constants in the docs
Example fix
// before
cfg := connectionConfig{AuthScheme: "sasl-digest"} // wrong separator
// after
cfg := connectionConfig{AuthScheme: "sasl_digest"} Defensive patterns
Strategy: validation
Validate before calling
switch cfg.AuthScheme {
case "", defaultAuthScheme, saslDigestAuthScheme:
// ok
default:
return fmt.Errorf("auth_scheme %q unsupported; use %q or %q", cfg.AuthScheme, defaultAuthScheme, saslDigestAuthScheme)
} Try / catch
_, err := openClient(cfg)
if err != nil && strings.HasPrefix(err.Error(), "Unsupported auth_scheme") {
return fmt.Errorf("fix auth_scheme in config: %w", err)
} Prevention
- Use the driver's exported constants instead of raw strings for auth_scheme
- Add a config schema/enum check at load time
- Watch for separators: it is "sasl_digest" (underscore), not "sasl-digest"
- Validate connection configs in CI before deployment
When it happens
Trigger: connectionConfig.AuthScheme resolves (via resolveAuthScheme) to something other than defaultAuthScheme or saslDigestAuthScheme — e.g. a typo like "sasl-digest" or an unsupported value like "digest" or "kerberos".
Common situations: Typo in auth_scheme in a connection file; copying a Kerberos/GSSAPI config from another ZooKeeper client; case-sensitivity mistakes in the scheme string.
Related errors
- ZooKeeper auth scheme and credentials must be configured tog
- ZooKeeper server list is empty
- ZooKeeper auth scheme and credentials must be configured tog
- username is required when auth_scheme = "sasl_digest"
- password is required when auth_scheme = "sasl_digest"
AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05).
Data as JSON: /api/errors/18e5aad6156c844a.
Report an issue: GitHub.