t8y2/dbx · error

ZooKeeper session closed because SASL authentication is requ

Error message

ZooKeeper session closed because SASL authentication is required

What it means

errZooKeeperSessionClosedRequiresSASL maps ZooKeeper error code -124 (Session closed because client failed to authenticate via SASL). zooKeeperError converts the server's close reason into this sentinel so callers can distinguish 'server requires SASL and auth failed/skipped' from other connection failures.

Source

Thrown at agents/drivers/hive-go/zookeeper_protocol.go:32

	"sync"
	"time"

	"github.com/beltran/gosasl"
	"github.com/go-zookeeper/zk"
)

const (
	zooKeeperProtocolVersion = int32(0)
	zooKeeperOpGetData       = int32(4)
	zooKeeperOpGetChildren2  = int32(12)
	zooKeeperOpClose         = int32(-11)
	zooKeeperOpSetAuth       = int32(100)
	zooKeeperOpSASL          = int32(102)
	zooKeeperMaxFrameSize    = 16 << 20
	zooKeeperMaxSASLRounds   = 8
)

var errZooKeeperSessionClosedRequiresSASL = errors.New("ZooKeeper session closed because SASL authentication is required")

type zooKeeperSASLClient interface {
	Start() ([]byte, error)
	Step([]byte) ([]byte, error)
	Complete() bool
	Dispose()
}

var newZooKeeperSASLClient = func(host string, config connectionConfig) (zooKeeperSASLClient, error) {
	service, options := zooKeeperGSSAPIOptions(config)
	mechanism, err := gosasl.NewGSSAPIMechanismWithOptions(service, options)
	if err != nil {
		return nil, err
	}
	return gosasl.NewSaslClient(host, mechanism), nil
}

var dialZooKeeperConnection = func(address string, timeout time.Duration, tlsConfig *tls.Config) (net.Conn, error) {

View on GitHub (pinned to c0390bff16)

Solutions

1. Enable Kerberos SASL on the client connection path (config.Kerberos.Enabled with valid keytab/principal) so the SASL handshake runs
2. Verify the ensemble's SASL provider and scheme match what the client negotiates (digest vs sasl)
3. Check server zoo.cfg and jaas.conf to confirm whether SASL is required or optional
4. Inspect server logs for the SASL failure reason (missing/invalid token, wrong principal)

Example fix

// before
conn, _, err := connectPlainZooKeeper(ctx, servers, timeout) // server requires SASL
// after
config.Kerberos.Enabled = true
config.Kerberos.Principal = "hive/_HOST@REALM"
config.Kerberos.Keytab = "/etc/security/keytabs/hive.keytab"
conn, _, err := connectKerberosZooKeeper(ctx, servers, timeout, tlsConfig, config)

// Go: ensure SASL credentials exist before dialing
if zkCfg.SASLRequired && !(cfg.Kerberos.Enabled && cfg.Kerberos.Keytab != "") {
    return errors.New("ZooKeeper requires SASL; configure Kerberos keytab/principal")
}

_, ch, err := connectZooKeeper(ctx, servers, timeout, tls, cfg)
if errors.Is(err, errZooKeeperSessionClosedRequiresSASL) {
    return fmt.Errorf("ZooKeeper requires SASL auth: %w", err) // fix config, no blind retry
}

When it happens

Trigger: Connecting to a ZooKeeper ensemble with digest authentication while the server enforces SASL; sending an auth payload the server rejects; code -124 returned during connection/authentication.

Common situations: ZooKeeper ensemble has quorum.auth.enableSasl=true with a required provider but the Hive/argo client connects without Kerberos/GSSAPI credentials; mismatched SASL schemes between client and server; misconfigured jaas/zk auth in the ensemble.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• ZooKeeper session closed because SASL authentication is requ
• start ZooKeeper GSSAPI negotiation: %w
• ZooKeeper SASL round %d: %w
• continue ZooKeeper GSSAPI negotiation at round %d: %w
• ZooKeeper Kerberos SASL requires Hive Kerberos credentials

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/35a939b0ded93df6. Report an issue: GitHub.