t8y2/dbx · error

ZooKeeper GSSAPI negotiation exceeded %d rounds

Error message

ZooKeeper GSSAPI negotiation exceeded %d rounds

What it means

Returned by protocolZooKeeperClient.authenticateSASL when GSSAPI negotiation with ZooKeeper did not complete within zooKeeperMaxSASLRounds rounds — the exchange kept producing challenges without the client reaching Complete(). This guards against an endless negotiation loop caused by a misbehaving server or mechanism mismatch.

Source

Thrown at agents/drivers/hive-go/zookeeper_protocol.go:229

			return fmt.Errorf("ZooKeeper SASL round %d: %w", round+1, requestErr)
		}
		decoder := newZooKeeperDecoder(response)
		challenge, decodeErr := decoder.bytes()
		if decodeErr != nil {
			return fmt.Errorf("decode ZooKeeper SASL round %d: %w", round+1, decodeErr)
		}
		if saslClient.Complete() {
			if len(challenge) != 0 {
				return errors.New("ZooKeeper sent an unexpected token after GSSAPI completion")
			}
			return nil
		}
		token, err = saslClient.Step(challenge)
		if err != nil {
			return fmt.Errorf("continue ZooKeeper GSSAPI negotiation at round %d: %w", round+1, err)
		}
	}
	return fmt.Errorf("ZooKeeper GSSAPI negotiation exceeded %d rounds", zooKeeperMaxSASLRounds)
}

func (client *protocolZooKeeperClient) AddAuth(scheme string, auth []byte) error {
	_, err := client.request(zooKeeperOpSetAuth, func(encoder *zooKeeperEncoder) {
		encoder.int32(0)
		encoder.string(scheme)
		encoder.bytes(auth)
	})
	return err
}

func (client *protocolZooKeeperClient) Children(path string) ([]string, *zk.Stat, error) {
	response, err := client.request(zooKeeperOpGetChildren2, func(encoder *zooKeeperEncoder) {
		encoder.string(path)
		encoder.boolean(false)
	})
	if err != nil {
		return nil, nil, err

View on GitHub (pinned to c0390bff16)

Solutions

1. Verify the ZooKeeper ensemble's SASL mechanism matches GSSAPI/Kerberos as implemented
2. Check server logs for negotiation restarts or errors
3. Confirm Kerberos tickets/keys are valid so negotiation can converge
4. If the server requires a different mechanism, adjust server-side SASL config to GSSAPI

When it happens

Trigger: Thrown at agents/drivers/hive-go/zookeeper_protocol.go:229 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/0ab5668b7582950d. Report an issue: GitHub.