401 Unauthorized error in Jaeger client integration

Answer the question first

For integration tests you should avoid the collector’s authentication entirely. Jaeger’s client library has no built‑in mock auth provider, but you can configure the collector (or a local test instance) to accept unauthenticated requests, or replace the reporter with an in‑memory implementation that never talks to a collector.

1. Mock / stub auth provider?

The client itself does not expose a hook for a fake auth provider. The usual pattern is to run a local Jaeger collector that is configured *without* authentication. If you must keep the auth flag enabled, you can point the client to a local stub endpoint that simply accepts the span payload and returns 200. This stub can be a tiny HTTP server written in Go or Node that ignores headers.

2. Collector flags / env vars to accept unauthenticated requests

• JAEGER_COLLECTOR_HTTP_AUTH_ENABLED=false – disables HTTP auth on the default Jaeger collector. Works with the all‑in‑one Docker image and the collector binary.
• JAEGER_COLLECTOR_HTTP_PORT=14268 – expose the collector on the expected port.
• If you run Jaeger via docker‑compose, add the following to the collector service:

• environment:
    - JAEGER_COLLECTOR_HTTP_AUTH_ENABLED=false
  

• When using a reverse proxy (e.g., Nginx), make sure the proxy is not adding its own Basic auth or token requirement for the collector’s endpoint.

3. In‑memory reporter pattern

Replace the network reporter with Jaeger’s InMemoryReporter (Go) or the equivalent in other languages. This reporter keeps spans in a local slice/array and never sends them to a collector, so no authentication is involved.

Example in Go:

import "github.com/uber/jaeger-client-go"
import "github.com/uber/jaeger-client-go/reporter"

reporter := reporter.NewInMemoryReporter()
tracer, _ := jaeger.NewTracer(
    "my-service",
    jaeger.NewConstSampler(true),
    reporter,
)
// use tracer in tests

For Java, use InMemoryReporter from the io.jaegertracing package. This approach completely removes the need for a collector during tests while still exercising the tracer API.

Steps for a CI‑friendly harness

1. Start a local Jaeger all‑in‑one container with auth disabled:

   docker run -d --name jaeger-test \
     -e JAEGER_COLLECTOR_HTTP_AUTH_ENABLED=false \
     -p 6831:6831/udp \
     -p 14268:14268 \
     jaegertracing/all-in-one:1.47
   

2. Configure the client to point to the test collector:

   export JAEGER_AGENT_HOST=localhost
   export JAEGER_AGENT_PORT=6831
   export JAEGER_ENDPOINT=http://localhost:14268/api/traces
   

3. Run your tests. If you prefer no network call, swap the reporter for an in‑memory one as shown above.
4. Verify by checking the collector logs: they should show no authentication errors and should record the received spans.

What if the collector is behind a proxy?

If you see a 401 even after disabling collector auth, the issue is likely the proxy. Check the proxy configuration for Basic auth or token requirements. Temporarily disable the proxy or add a rule to allow unauthenticated traffic to the collector port during tests.

Ask for missing diagnostic detail

To refine the recommendation, could you confirm whether the Jaeger collector is exposed directly or via a reverse proxy that might add its own authentication? This will determine if the solution should focus on collector flags or proxy configuration.