apache/beam · error · java.lang.IllegalArgumentException

Exactly one authentication method must be configured…

Error message

Exactly one authentication method must be configured: password, oauthToken, or privateKey.

What it means

SnowflakeSchemaTransformUtils.validateAuthentication counts the configured authentication methods (password, oauthToken, privateKey) and throws IllegalArgumentException when the count is not exactly 1. Snowflake sinks/reads in schema-transform form require precisely one auth mechanism.

Solutions

1. Keep exactly one of: password, oauthToken, or privateKey — remove the others.
2. If migrating to key-pair auth, clear the password field.
3. Ensure empty strings are nulled out rather than passed as "".
4. Verify option-precedence code isn't copying multiple secrets from a secret manager into the config.

Example fix

// before
builder.setPassword(pw).setPrivateKey(pem); // two methods
// after
builder.setPrivateKey(pem);

int methods = 0;
if (isNotEmpty(password)) methods++;
if (isNotEmpty(oauthToken)) methods++;
if (isNotEmpty(privateKey)) methods++;
if (methods != 1) throw new IllegalArgumentException("Configure exactly one of password, oauthToken, privateKey");

When it happens

Trigger: Setting zero auth options (all null/empty), or two+ of password, oauthToken, privateKey simultaneously.

Common situations: Providing both password and privateKey during a migration from password to key-pair auth; empty-string values counted/ignored inconsistently; defaults injected by the runner plus user-supplied options.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• username is required for password and private key…
• Either table or query must be specified.
• Missing credentials values. Please check your credentials
• name + " cannot be empty"
• privateKeyPassphrase requires privateKey.

AI-assisted analysis of apache/beam@12126d8942 (2026-09-13). Data as JSON: /api/errors/1aea296bc85f6b25. Report an issue: GitHub.

Appendix: source

Thrown at sdks/java/io/snowflake/src/main/java/org/apache/beam/sdk/io/snowflake/SnowflakeSchemaTransformUtils.java:105

      @Nullable String privateKey,
      @Nullable String privateKeyPassphrase) {

    int authenticationMethods = 0;

    if (isNotEmpty(password)) {
      authenticationMethods++;
    }

    if (isNotEmpty(oauthToken)) {
      authenticationMethods++;
    }

    if (isNotEmpty(privateKey)) {
      authenticationMethods++;
    }

    if (authenticationMethods != 1) {
      throw new IllegalArgumentException(
          "Exactly one authentication method must be configured: "
              + "password, oauthToken, or privateKey.");
    }

    if ((isNotEmpty(password) || isNotEmpty(privateKey)) && !isNotEmpty(username)) {
      throw new IllegalArgumentException(
          "username is required for password and private key authentication.");
    }

    if (isNotEmpty(privateKeyPassphrase) && !isNotEmpty(privateKey)) {
      throw new IllegalArgumentException("privateKeyPassphrase requires privateKey.");
    }
  }

  @EnsuresNonNullIf(expression = "#1", result = true)
  public static boolean isNotEmpty(@Nullable String value) {
    return value != null && !value.isEmpty();
  }

View on GitHub (pinned to 12126d8942)