diff --git a/src/inc/taoserror.h b/src/inc/taoserror.h
index b5ab4412a9b4f41821b9b0fa00e303f467c4e316..f9bc1404fe2895ac26b43ec08ffb0a8bc21df67d 100644
--- a/src/inc/taoserror.h
+++ b/src/inc/taoserror.h
@@ -74,6 +74,7 @@ TAOS_DEFINE_ERROR(TSDB_CODE_INVALID_OPTION,             0, 26, "invalid option")
 TAOS_DEFINE_ERROR(TSDB_CODE_NOT_CONFIGURED,             0, 27, "not configured")
 TAOS_DEFINE_ERROR(TSDB_CODE_NODE_OFFLINE,               0, 28, "node offline")
 TAOS_DEFINE_ERROR(TSDB_CODE_NETWORK_UNAVAIL,            0, 29, "network unavailable")
+TAOS_DEFINE_ERROR(TSDB_CODE_AUTH_REQUIRED,              0, 30, "auth required")
 
 // db
 TAOS_DEFINE_ERROR(TSDB_CODE_DB_NOT_SELECTED,            0, 100, "db not selected")
diff --git a/src/rpc/src/rpcMain.c b/src/rpc/src/rpcMain.c
index ca4b211be880e361f5433b932afbfa8553635abd..3e638eb3d3bf0300023494941859b6d33b2b4a3e 100644
--- a/src/rpc/src/rpcMain.c
+++ b/src/rpc/src/rpcMain.c
@@ -612,7 +612,12 @@ static SRpcConn *rpcAllocateServerConn(SRpcInfo *pRpc, SRecvInfo *pRecv) {
     pConn->ownId = htonl(pConn->sid);
     pConn->linkUid = pHead->linkUid;
     if (pRpc->afp) {
-      terrno = (*pRpc->afp)(pConn->user, &pConn->spi, &pConn->encrypt, pConn->secret, pConn->ckey);
+      if (pConn->user[0] == 0) {
+        terrno = TSDB_CODE_AUTH_REQUIRED;
+      } else {
+        terrno = (*pRpc->afp)(pConn->user, &pConn->spi, &pConn->encrypt, pConn->secret, pConn->ckey);
+      }
+
       if (terrno != 0) {
         tWarn("%s %p, user not there or server not ready", pRpc->label, pConn);
         taosFreeId(pRpc->idPool, sid);   // sid shall be released
@@ -930,6 +935,12 @@ static void rpcProcessIncomingMsg(SRpcConn *pConn, SRpcHead *pHead) {
     rpcMsg.handle = pContext->ahandle;
     pConn->pContext = NULL;
 
+    if (pHead->code == TSDB_CODE_AUTH_REQUIRED) {
+      pConn->secured = 0;
+      rpcSendReqToServer(pRpc, pContext);
+      return;
+    }
+
     // for UDP, port may be changed by server, the port in ipSet shall be used for cache
     rpcAddConnIntoCache(pRpc->pCache, pConn, pConn->peerFqdn, pContext->ipSet.port[pContext->ipSet.inUse], pConn->connType);