t8y2/dbx · error

ZooKeeper authentication failed

Error message

ZooKeeper authentication failed

What it means

After connecting, openClient watches session events for zk.StateAuthFailed. When the ZooKeeper server rejects the client's authentication (an ACL-auth failure event), the connection is closed and 'ZooKeeper authentication failed' is returned. It means the server refused the credentials presented for the digest auth scheme.

Source

Thrown at agents/drivers/zookeeper/connection.go:220

	if err != nil {
		return nil, err
	}
	connected := false
	timer := time.NewTimer(connectionTimeout)
	defer timer.Stop()
	for !connected {
		select {
		case event, open := <-events:
			if !open {
				connection.Close()
				return nil, errors.New("Connection timed out")
			}
			if event.State == zk.StateHasSession {
				connected = true
			}
			if event.State == zk.StateAuthFailed {
				connection.Close()
				return nil, errors.New("ZooKeeper authentication failed")
			}
		case <-timer.C:
			connection.Close()
			return nil, errors.New("Connection timed out")
		}
	}

	if authScheme == defaultAuthScheme && strings.TrimSpace(config.Username) != "" {
		credentials := []byte(strings.TrimSpace(config.Username) + ":" + config.Password)
		if err := connection.AddAuth(defaultAuthScheme, credentials); err != nil {
			connection.Close()
			return nil, err
		}
	}

	prefix := joinPrefix(target.Chroot, config.Namespace)
	retryBase := defaultBaseSleepTime
	if config.BaseSleepTimeMS != nil {

View on GitHub (pinned to c0390bff16)

Solutions

1. Verify Username and Password in the config match a digest user registered on the ZooKeeper ensemble (server side: addauth digest user:pass, then setAcl).
2. Re-create the credential after rotation and update the client config.
3. Check the server's SASL/jaas configuration (java.env, jaasLoginContextName) if DIGEST-MD5 is enforced.
4. Test the same credentials with zkCli.sh to confirm they are accepted before debugging this library.

Example fix

// before
config.Username = "svc"
config.Password = "old-pass"
// after
config.Username = "svc"
config.Password = "correct-rotated-pass"

// Validate credentials are present before connecting
if cfg.Username != "" && cfg.Password == "" {
    return errors.New("zookeeper auth: username set but password empty")
}
// Optionally verify credentials out-of-band with zkCli before app start

session, err := openClient(cfg)
if err != nil {
    if strings.Contains(err.Error(), "authentication failed") {
        return fmt.Errorf("zookeeper credentials rejected; check Username/Password and server ACLs: %w", err)
    }
    return err
}

When it happens

Trigger: The zk driver emits StateAuthFailed after openClient calls AddAuth with username:password digest credentials — i.e. the configured Username/Password do not match a digest user on the server, or SASL digest negotiation (negotiateSASLDigest) is rejected. Raised in agents/drivers/zookeeper/connection.go:220.

Common situations: Wrong username/password in the connection config; digest credentials not created on the ZooKeeper ensemble (no addauth digest user:pass done server-side); password changed or rotated; SASL/DIGEST-MD5 misconfigured on the server (jaasLoginContextName mismatch); chroot or ACLs denying the user.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• ZooKeeper authentication failed
• ZooKeeper session closed because SASL authentication is requ
• ZooKeeper authentication failed
• ZooKeeper session closed because SASL authentication is requ
• username is required when auth_scheme = "sasl_digest"

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/ab925409251aaa63. Report an issue: GitHub.