t8y2/dbx · error

ZooKeeper authentication failed

Error message

ZooKeeper authentication failed

What it means

After connecting, openClient watches session events for zk.StateAuthFailed. When the ZooKeeper server rejects the client's authentication (an ACL-auth failure event), the connection is closed and 'ZooKeeper authentication failed' is returned. It means the server refused the credentials presented for the digest auth scheme.

Solutions

1. Verify Username and Password in the config match a digest user registered on the ZooKeeper ensemble (server side: addauth digest user:pass, then setAcl).
2. Re-create the credential after rotation and update the client config.
3. Check the server's SASL/jaas configuration (java.env, jaasLoginContextName) if DIGEST-MD5 is enforced.
4. Test the same credentials with zkCli.sh to confirm they are accepted before debugging this library.

Example fix

// before
config.Username = "svc"
config.Password = "old-pass"
// after
config.Username = "svc"
config.Password = "correct-rotated-pass"

// Validate credentials are present before connecting
if cfg.Username != "" && cfg.Password == "" {
    return errors.New("zookeeper auth: username set but password empty")
}
// Optionally verify credentials out-of-band with zkCli before app start

session, err := openClient(cfg)
if err != nil {
    if strings.Contains(err.Error(), "authentication failed") {
        return fmt.Errorf("zookeeper credentials rejected; check Username/Password and server ACLs: %w", err)
    }
    return err
}

When it happens

Trigger: The zk driver emits StateAuthFailed after openClient calls AddAuth with username:password digest credentials — i.e. the configured Username/Password do not match a digest user on the server, or SASL digest negotiation (negotiateSASLDigest) is rejected. Raised in agents/drivers/zookeeper/connection.go:220.

Common situations: Wrong username/password in the connection config; digest credentials not created on the ZooKeeper ensemble (no addauth digest user:pass done server-side); password changed or rotated; SASL/DIGEST-MD5 misconfigured on the server (jaasLoginContextName mismatch); chroot or ACLs denying the user.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• continue ZooKeeper DIGEST-MD5 negotiation at round
• continue ZooKeeper GSSAPI negotiation at round
• password is required when auth_scheme = "sasl_digest"
• start ZooKeeper DIGEST-MD5 negotiation
• start ZooKeeper GSSAPI negotiation

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/ab925409251aaa63. Report an issue: GitHub.

Appendix: source

Thrown at agents/drivers/zookeeper/connection.go:220

	if err != nil {
		return nil, err
	}
	connected := false
	timer := time.NewTimer(connectionTimeout)
	defer timer.Stop()
	for !connected {
		select {
		case event, open := <-events:
			if !open {
				connection.Close()
				return nil, errors.New("Connection timed out")
			}
			if event.State == zk.StateHasSession {
				connected = true
			}
			if event.State == zk.StateAuthFailed {
				connection.Close()
				return nil, errors.New("ZooKeeper authentication failed")
			}
		case <-timer.C:
			connection.Close()
			return nil, errors.New("Connection timed out")
		}
	}

	if authScheme == defaultAuthScheme && strings.TrimSpace(config.Username) != "" {
		credentials := []byte(strings.TrimSpace(config.Username) + ":" + config.Password)
		if err := connection.AddAuth(defaultAuthScheme, credentials); err != nil {
			connection.Close()
			return nil, err
		}
	}

	prefix := joinPrefix(target.Chroot, config.Namespace)
	retryBase := defaultBaseSleepTime
	if config.BaseSleepTimeMS != nil {

View on GitHub (pinned to c0390bff16)