fix: reset _authentication_state to none

[AldoFusterTurpin]

I am not a C++ developer (good memories from college 😆 ), but I was investigating this issue I faced and then I discovered this...

When the schema registry client tries to connect to a broker, it calls connect_with_retries() → connect() → do_connect(), which opens a TCP+TLS connection and stores it in _fd. Then maybe_authenticate() is called and throws sasl_authentication_failed.

State after auth failure:

_fd = non-null (TLS socket open, TCP alive) → is_valid() = true
_authentication_state = in_progress (never reset to none)

Every subsequent retry (every ~20s):

• maybe_initialize_connection() checks: is_valid()==true AND needs_authentication()==false (state is in_progress, not none)
• Returns early. The broker is permanently stuck, it thinks it has a valid connection that doesn't need authentication, but authentication never succeeded.

The TCP connection eventually drops (keepalive timeout). Then is_valid() = false, connect_with_retries() proceeds, allocates a new connection, auth fails again, and the cycle repeats. The broker never successfully authenticates.

What call is missing: the catch block in maybe_authenticate() needs to reset _authentication_state to none so that the next retry actually attempts to reconnect and re-authenticate:

    } catch (...) {
        _authentication_state = auth_state::none;  // allow retry to reconnect and re-authenticate
        vlog(_logger.warn, "Authentication error - {}", std::current_exception());
        throw;
    }

The TLDR; We do the code change so the next call to maybe_initialize_connection() sees needs_authentication()==true and retries the full reconnect+authenticate sequence instead of returning early.

Backports Required

• none - not a bug fix
• none - this is a backport
• none - issue does not exist in previous branches
• none - papercut/not impactful enough to backport
• v26.1.x
• v25.3.x
• v25.2.x

Release Notes

Bug Fixes

• Fix Kafka client broker getting stuck in in_progress authentication state after a SASL authentication failure, preventing subsequent retries from re-attempting authentication.

[CLAassistant]

All committers have signed the CLA.

[Copilot]

Pull request overview

Fixes a Kafka client broker-connection edge case where a SASL authentication failure could leave remote_broker stuck in an in_progress authentication state, preventing subsequent retries from re-attempting authentication.

Changes:

• Reset _authentication_state back to auth_state::none when maybe_authenticate() throws, enabling future authentication attempts on retry.

[dotnwat]

Thanks!

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.