ZooKeeper session closed because SASL authentication is requ

Error message

ZooKeeper session closed because SASL authentication is required

What it means

errZooKeeperSessionClosedRequiresSASL is a sentinel error returned by zooKeeperError when the ZooKeeper broker closes the session with error code -124, meaning the server requires SASL (Kerberos/GSSAPI) authentication but the client did not authenticate. It is checked with errors.Is and is stable for programmatic matching.

Source

Thrown at agents/drivers/argo-go/zookeeper_protocol.go:32

	"sync"
	"time"

	"github.com/beltran/gosasl"
	"github.com/go-zookeeper/zk"
)

const (
	zooKeeperProtocolVersion = int32(0)
	zooKeeperOpGetData       = int32(4)
	zooKeeperOpGetChildren2  = int32(12)
	zooKeeperOpClose         = int32(-11)
	zooKeeperOpSetAuth       = int32(100)
	zooKeeperOpSASL          = int32(102)
	zooKeeperMaxFrameSize    = 16 << 20
	zooKeeperMaxSASLRounds   = 8
)

var errZooKeeperSessionClosedRequiresSASL = errors.New("ZooKeeper session closed because SASL authentication is required")

type zooKeeperSASLClient interface {
	Start() ([]byte, error)
	Step([]byte) ([]byte, error)
	Complete() bool
	Dispose()
}

var newZooKeeperSASLClient = func(host string, config connectionConfig) (zooKeeperSASLClient, error) {
	service, options := zooKeeperGSSAPIOptions(config)
	mechanism, err := gosasl.NewGSSAPIMechanismWithOptions(service, options)
	if err != nil {
		return nil, err
	}
	return gosasl.NewSaslClient(host, mechanism), nil
}

var dialZooKeeperConnection = func(address string, timeout time.Duration, tlsConfig *tls.Config) (net.Conn, error) {

View on GitHub (pinned to c0390bff16)

Solutions

Enable Kerberos/SASL for the ZooKeeper connection (configure Hive Kerberos credentials so connectKerberosZooKeeper is used)
Verify the server's zoo.cfg requires SASL and match client jaas/keytab configuration accordingly
Check with errors.Is(err, errZooKeeperSessionClosedRequiresSASL) to distinguish auth-required from other ZooKeeper failures
Confirm clock skew and valid keytabs — failed GSSAPI setup can surface as server-rejected sessions

Example fix

// before
zkConn, events, err := connectZooKeeper(servers, timeout, tlsConfig, connectionConfig{})
// after
cfg := connectionConfig{Kerberos: kerberos.Config{Enabled: true, /* keytab, principal... */}}
zkConn, events, err := connectKerberosZooKeeper(servers, timeout, tlsConfig, cfg)

Defensive patterns

Strategy: validation

Validate before calling

if !cfg.Kerberos.Enabled {
    return errors.New("target ZooKeeper ensemble requires SASL; enable Kerberos credentials")
}

Try / catch

conn, events, err := connectZooKeeper(...)
if errors.Is(err, errZooKeeperSessionClosedRequiresSASL) {
    // reconfigure with Kerberos/SASL enabled and reconnect
}

Prevention

Match client SASL settings to the ensemble's zoo.cfg auth requirements
Enable Kerberos whenever the cluster is secured
Check errors.Is against the sentinel error, not string matching
Validate keytabs and clock sync before deploy

When it happens

Trigger: Connecting to a ZooKeeper ensemble where the server enforces SASL (zookeeper.auth.enabled / quorum.auth) while the client connects without Kerberos credentials; calling authenticateSASL with a client whose SASL negotiation fails such that the server responds with -124.

Common situations: Pointing a non-Kerberized driver at a secured ZooKeeper ensemble; enabling Kerberos on Hive but not ZooKeeper client SASL; server-side security policy tightened (version/config change) breaking previously working unauthenticated clients.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/fcb0a15e89ec8ebc. Report an issue: GitHub.