t8y2/dbx · error

ZooKeeper authentication failed

Error message

ZooKeeper authentication failed

What it means

The ZooKeeper client delivered a connection event with state StateAuthFailed, meaning the server rejected the supplied authentication credentials (e.g. digest ACL mismatch). The wait loop converts this terminal state into this explicit error so callers know the session will not be usable.

Source

Thrown at agents/drivers/argo-go/discovery.go:210

	defer timer.Stop()
	for {
		select {
		case <-ctx.Done():
			return ctx.Err()
		case <-timer.C:
			return errors.New("ZooKeeper connection timed out before a session was established")
		case event, ok := <-events:
			if !ok {
				return errors.New("ZooKeeper event stream closed before a session was established")
			}
			if event.Err != nil {
				return fmt.Errorf("ZooKeeper connection event: %w", event.Err)
			}
			switch event.State {
			case zk.StateHasSession:
				return nil
			case zk.StateAuthFailed:
				return errors.New("ZooKeeper authentication failed")
			case zk.StateExpired:
				return errors.New("ZooKeeper session expired during connection")
			}
		}
	}
}

func parseHiveServerRegistration(child string, data []byte) (endpoint, error) {
	candidates := []string{strings.TrimSpace(string(data)), strings.TrimSpace(child)}
	for _, candidate := range candidates {
		if candidate == "" {
			continue
		}
		if value, err := endpointFromRegistrationJSON(candidate); err == nil {
			return value, nil
		}
		parameters := parseHiveParameters(candidate)
		for _, key := range []string{"serveruri", "hiveserver2uri", "server_uri"} {

View on GitHub (pinned to c0390bff16)

Solutions

1. Correct the auth scheme/credentials so they match the ZooKeeper ACLs (digest 'user:password')
2. Verify Kerberos/SASL setup if using a scheme requiring external configuration
3. Connect without auth to a quorum/namespace whose ACLs permit anonymous read if that is intended

Example fix

// before
auth: "svc:user" // wrong credential string
// after
auth: "svc:correctpassword"

// sanity check credentials before connecting
if cfg.ZKAuthScheme == "digest" && !strings.Contains(cfg.ZKAuth, ":") {
	return errors.New("digest auth must be 'user:password'")
}

endpoints, err := discovery.Endpoints(ctx)
if err != nil {
	if strings.Contains(err.Error(), "authentication failed") {
		// do NOT retry with same credentials; surface config problem
		return fmt.Errorf("check zookeeper authScheme/auth: %w", err)
	}
}

When it happens

Trigger: Endpoints() adds auth via AddAuth (authScheme/auth pair) and the ZooKeeper server responds with auth failure during session establishment; exercised by TestWaitForZooKeeperSessionRejectsAuthFailure.

Common situations: Wrong username/password in digest credentials; credentials not matching the znode ACLs; using a scheme the server does not support (e.g. sasl without Kerberos configured); stale credentials after a ZooKeeper config change.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• ZooKeeper authentication failed
• ZooKeeper auth scheme and credentials must be configured tog
• ZooKeeper session closed because SASL authentication is requ
• ZooKeeper auth scheme and credentials must be configured tog
• ZooKeeper authentication failed

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/faee3164e98ce715. Report an issue: GitHub.