vitessio/vitess · error · ErrUnregisteredAuthenticationImpl

%w %s

Error message

%w %s

What it means

vtadmin's RBAC config `Reify` fails when the configured `authenticator` name does not match any implementation registered in the `authenticators` map. The error wraps `ErrUnregisteredAuthenticationImpl` and appends the unknown authenticator name. This is a fail-fast guard so vtadmin never starts with a silently absent authorizer backend.

Source

Thrown at go/vt/vtadmin/rbac/config.go:141

	c.cfg = byResource
	c.authorizer = &Authorizer{
		policies: c.cfg,
	}

	// reify the authenticator
	switch {
	case strings.HasSuffix(c.Authenticator, ".so"):
		authn, err := loadAuthenticatorPlugin(c.Authenticator)
		if err != nil {
			return err
		}

		c.authenticator = authn
	case c.Authenticator != "":
		factory, ok := authenticators[c.Authenticator]
		if !ok {
			return fmt.Errorf("%w %s", ErrUnregisteredAuthenticationImpl, c.Authenticator)
		}

		c.authenticator = factory()
	default:
		log.Info("[rbac]: no authenticator implementation specified")
		c.authenticator = nil // Technically a no-op, but being super explicit about it.
	}

	c.reified = true
	return nil
}

// GetAuthenticator returns the Authenticator implementation specified by the
// config. It returns nil if the Authenticator string field is the empty string,
// or if a call to Reify has not been made.
func (c *Config) GetAuthenticator() Authenticator {
	return c.authenticator
}

View on GitHub (pinned to 01a25a7d17)

Solutions

1. Check the authenticator name in the vtadmin config against the keys registered in go/vt/vtadmin/rbac/authenticator (grpcclient, etcd, file, etc.) and fix the spelling.
2. Ensure the package containing the authenticator's init() registration is imported (directly or via a supported-imports file) in the vtadmin binary being run.
3. If no authenticator is wanted, remove the authenticator setting so Reify takes the default branch and logs 'no authenticator implementation specified'.

Example fix

// before (config)
{"authenticator": "grpc"}
// after
{"authenticator": "grpcclient"}

// Go: check registration before calling Reify
if cfg.Authenticator != "" {
    if _, ok := rbac.GetRegisteredAuthenticators()[cfg.Authenticator]; !ok {
        return fmt.Errorf("authenticator %q is not registered; check name and imports", cfg.Authenticator)
    }
}

err := cfg.Reify(); if err != nil && errors.Is(err, rbac.ErrUnregisteredAuthenticationImpl) { /* fix config name or register impl */ }

When it happens

Trigger: Calling rbac.Config.Reify when Config.Authenticator is set to a non-empty string that is not a key in the authenticators registry (e.g. a typo like 'grpc' vs 'grpcclient', or a custom authenticator whose init() registration was never imported).

Common situations: Typoed authenticator name in vtadmin config; blank or forgotten import of the package that registers the authenticator via init(); renaming/moving an authenticator implementation across Vitess versions while the config file still references the old name.

Related errors

• unregistered Authenticator implementation
• symbol NewAuthenticator must be of type `func() Authenticato
• failed to load static auth plugin. Plugin configured but grp
• %w: cannot create schema migration in %s
• %w: cannot cancel schema migration in %s

AI-assisted analysis of vitessio/vitess@01a25a7d17 (2026-09-01). Data as JSON: /api/errors/33f6965d486120e9. Report an issue: GitHub.