apache/druid · error · ISE

Specify only one of or

Error message

Specify only one of %s or %s

What it means

HttpInputSourceDefn rejects HTTP input source configs that supply both a plain-text password and a password environment variable. The Druid catalog table definition converts user-supplied args into an input source JSON map and requires exactly one password mechanism so credentials are unambiguous. Thrown as IllegalStateException during arg conversion.

Solutions

1. Remove either the password parameter or the passwordEnvVar parameter from the table args, keeping exactly one
2. Prefer the env-var form for security and delete the literal password
3. If config is templated, guard so only one of the two keys is ever emitted

Example fix

// before
args: {"user":"u", "password":"secret", "passwordEnvVar":"HTTP_PW"}
// after
args: {"user":"u", "passwordEnvVar":"HTTP_PW"}

if (args.containsKey("password") && args.containsKey("passwordEnvVar")
    && args.get("password") != null && args.get("passwordEnvVar") != null) {
  throw new IllegalArgumentException("Set only one of password or passwordEnvVar");
}

try { defn.convertArgsToSourceMap(args); } catch (IllegalStateException e) { if (e.getMessage().contains("Specify only one of")) { /* fix config: drop one credential key */ } else { throw e; } }

When it happens

Trigger: Calling convertArgsToSourceMap or convertCompletedTable on an HTTP input source table whose args contain non-null values for both the password parameter and the password-env-var parameter.

Common situations: A developer pastes an example config that uses an env var but leaves the old literal password key in place; migration from literal credentials to env-var credentials without deleting the old field; templated configs where both keys are rendered non-empty.

Understand the failure class

Background: "mutually exclusive" flag errors: what "can't supply both nx and xx", "--raw is not compatible with -i" and "cannot be used with" mean, and how to fix them — this error's family across 29 libraries.

Related errors

• A local input source accepts only one of
• Bad URL
• Cannot define both uri and fileRegex
• Either uri xor uriPrefix required
• External HTTP tables must provide only one of a URI or a

AI-assisted analysis of apache/druid@9b90983fd2 (2026-09-07). Data as JSON: /api/errors/790c33aef14118fd. Report an issue: GitHub.

Appendix: source

Thrown at server/src/main/java/org/apache/druid/catalog/model/table/HttpInputSourceDefn.java:338

  }

  /**
   * Convert the user name and password. All are SQL strings. Passwords must be in
   * the form of a password provider, so do the needed conversion. HTTP provides
   * two kinds of passwords (plain test an reference to an env var), but at most
   * one can be provided.
   */
  private void convertUserPasswordArgs(Map<String, Object> jsonMap, Map<String, Object> args)
  {
    String user = CatalogUtils.getString(args, USER_PARAMETER);
    if (user != null) {
      jsonMap.put(USERNAME_FIELD, user);
    }
    String password = CatalogUtils.getString(args, PASSWORD_PARAMETER);
    String passwordEnvVar = CatalogUtils.getString(args, PASSWORD_ENV_VAR_PARAMETER);
    if (password != null && passwordEnvVar != null) {
      throw new ISE(
          "Specify only one of %s or %s",
          PASSWORD_PARAMETER,
          PASSWORD_ENV_VAR_PARAMETER
      );
    }
    if (password != null) {
      jsonMap.put(
          PASSWORD_FIELD,
          ImmutableMap.of("type", DefaultPasswordProvider.TYPE_KEY, "password", password)
      );
    } else if (passwordEnvVar != null) {
      jsonMap.put(
          PASSWORD_FIELD,
          ImmutableMap.of("type", EnvironmentVariablePasswordProvider.TYPE_KEY, "variable", passwordEnvVar)
      );
    }
  }
}

View on GitHub (pinned to 9b90983fd2)