ZooKeeper auth scheme and credentials must be configured tog

Error message

ZooKeeper auth scheme and credentials must be configured together

What it means

Endpoints() validates ZooKeeper SASL configuration before authenticating: if either authScheme or auth is set but not both, configuration is incomplete and the discovery refuses to proceed. This prevents sending a malformed AddAuth call to the ZooKeeper ensemble.

Source

Thrown at agents/drivers/hive-go/discovery.go:114

	addresses := make([]string, 0, len(discovery.servers))
	for _, server := range discovery.servers {
		addresses = append(addresses, server.address())
	}
	timeout := discovery.timeout
	if timeout <= 0 {
		timeout = defaultConnectTimeout
	}
	connection, events, err := discovery.dialer(addresses, timeout)
	if err != nil {
		return nil, fmt.Errorf("connect to ZooKeeper: %w", err)
	}
	defer connection.Close()
	if err := waitForZooKeeperSession(ctx, events, timeout); err != nil {
		return nil, err
	}
	if discovery.authScheme != "" || discovery.auth != "" {
		if discovery.authScheme == "" || discovery.auth == "" {
			return nil, errors.New("ZooKeeper auth scheme and credentials must be configured together")
		}
		if err := connection.AddAuth(discovery.authScheme, []byte(discovery.auth)); err != nil {
			return nil, fmt.Errorf("authenticate to ZooKeeper: %w", err)
		}
	}
	resolved := make([]endpoint, 0)
	var listedPath string
	var nodeFailures []string
	for _, path := range discovery.paths() {
		children, _, childrenErr := connection.Children(path)
		if errors.Is(childrenErr, zk.ErrNoNode) {
			continue
		}
		if childrenErr != nil {
			return nil, fmt.Errorf("list ZooKeeper namespace %s: %w", path, childrenErr)
		}
		listedPath = path
		for _, child := range children {

View on GitHub (pinned to c0390bff16)

Solutions

Set both authScheme (e.g. "digest") and auth ("user:password") together in the discovery config
Remove both fields if no ZooKeeper auth is actually required
Validate config at startup so one-sided auth values fail fast
Check documentation for the expected auth format (scheme name plus user:password payload)

Example fix

// before
discovery.authScheme = "digest" // auth missing
// after
discovery.authScheme = "digest"
discovery.auth = "hive:hivepassword"

Defensive patterns

Strategy: validation

Validate before calling

func validateZKAuth(scheme, auth string) error {
    if (scheme == "") != (auth == "") {
        return errors.New("ZooKeeper auth scheme and credentials must both be set or both empty")
    }
    return nil
}
// call before constructing the discovery
err := validateZKAuth(cfg.ZKAuthScheme, cfg.ZKAuth)

Prevention

Always set authScheme and auth as a pair in config structs
Fail config validation at application startup, not at first Endpoints call
Document that auth is scheme-qualified (e.g. digest uses user:password)

When it happens

Trigger: Calling Endpoints on a ZooKeeper discovery constructed with only authScheme set (e.g. "digest") or only auth credentials set, without the matching counterpart.

Common situations: Configuring only zookeeper.auth.scheme in a config file assuming the library adds the default scheme, or passing credentials without the scheme after migrating from a client that inferred it.

Related errors

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/c5fea659cc29ae3d. Report an issue: GitHub.