apache/druid · error · ISE

Specify only one of %s or %s

Error message

Specify only one of %s or %s

What it means

HttpInputSourceDefn rejects HTTP input source configs that supply both a plain-text password and a password environment variable. The Druid catalog table definition converts user-supplied args into an input source JSON map and requires exactly one password mechanism so credentials are unambiguous. Thrown as IllegalStateException during arg conversion.

Source

Thrown at server/src/main/java/org/apache/druid/catalog/model/table/HttpInputSourceDefn.java:338

  }

  /**
   * Convert the user name and password. All are SQL strings. Passwords must be in
   * the form of a password provider, so do the needed conversion. HTTP provides
   * two kinds of passwords (plain test an reference to an env var), but at most
   * one can be provided.
   */
  private void convertUserPasswordArgs(Map<String, Object> jsonMap, Map<String, Object> args)
  {
    String user = CatalogUtils.getString(args, USER_PARAMETER);
    if (user != null) {
      jsonMap.put(USERNAME_FIELD, user);
    }
    String password = CatalogUtils.getString(args, PASSWORD_PARAMETER);
    String passwordEnvVar = CatalogUtils.getString(args, PASSWORD_ENV_VAR_PARAMETER);
    if (password != null && passwordEnvVar != null) {
      throw new ISE(
          "Specify only one of %s or %s",
          PASSWORD_PARAMETER,
          PASSWORD_ENV_VAR_PARAMETER
      );
    }
    if (password != null) {
      jsonMap.put(
          PASSWORD_FIELD,
          ImmutableMap.of("type", DefaultPasswordProvider.TYPE_KEY, "password", password)
      );
    } else if (passwordEnvVar != null) {
      jsonMap.put(
          PASSWORD_FIELD,
          ImmutableMap.of("type", EnvironmentVariablePasswordProvider.TYPE_KEY, "variable", passwordEnvVar)
      );
    }
  }
}

View on GitHub (pinned to 9b90983fd2)

Solutions

1. Remove either the password parameter or the passwordEnvVar parameter from the table args, keeping exactly one
2. Prefer the env-var form for security and delete the literal password
3. If config is templated, guard so only one of the two keys is ever emitted

Example fix

// before
args: {"user":"u", "password":"secret", "passwordEnvVar":"HTTP_PW"}
// after
args: {"user":"u", "passwordEnvVar":"HTTP_PW"}

if (args.containsKey("password") && args.containsKey("passwordEnvVar")
    && args.get("password") != null && args.get("passwordEnvVar") != null) {
  throw new IllegalArgumentException("Set only one of password or passwordEnvVar");
}

try { defn.convertArgsToSourceMap(args); } catch (IllegalStateException e) { if (e.getMessage().contains("Specify only one of")) { /* fix config: drop one credential key */ } else { throw e; } }

When it happens

Trigger: Calling convertArgsToSourceMap or convertCompletedTable on an HTTP input source table whose args contain non-null values for both the password parameter and the password-env-var parameter.

Common situations: A developer pastes an example config that uses an env var but leaves the old literal password key in place; migration from literal credentials to env-var credentials without deleting the old field; templated configs where both keys are rendered non-empty.

Understand the failure class

Background: "mutually exclusive" flag errors: what "can't supply both nx and xx", "--raw is not compatible with -i" and "cannot be used with" mean, and how to fix them — this error's family across 29 libraries.

Related errors

• Set only one of 'key' or 'sharedAccessStorageToken' or 'useA
• Either uri xor uriPrefix required
• Cannot define both uri and fileRegex
• Requested to skip [%s] bytes, but actual number of bytes ski
• Only %s protocols are allowed

AI-assisted analysis of apache/druid@9b90983fd2 (2026-09-07). Data as JSON: /api/errors/790c33aef14118fd. Report an issue: GitHub.