{"record":{"id":"01b00fefcac1a9f7","repo":"risingwavelabs/risingwave","slug":"auth-method-key-pair-object-must-not-set-password","errorCode":null,"errorMessage":"auth.method=key_pair_object must not set `password`","messagePattern":"auth\\.method=key_pair_object must not set `password`","errorType":"validation","errorClass":"SinkError::Config","httpStatus":null,"severity":"error","filePath":"src/connector/src/sink/snowflake_redshift/snowflake.rs","lineNumber":319,"sourceCode":"                    return Err(SinkError::Config(anyhow!(\n                        \"auth.method=key_pair_file must not set `password`\"\n                    )));\n                }\n                if has_pem {\n                    return Err(SinkError::Config(anyhow!(\n                        \"auth.method=key_pair_file must not set `private_key_pem`\"\n                    )));\n                }\n                AUTH_METHOD_KEY_PAIR_FILE.to_owned()\n            }\n            Some(method) if method == AUTH_METHOD_KEY_PAIR_OBJECT => {\n                if !has_pem {\n                    return Err(SinkError::Config(anyhow!(\n                        \"auth.method=key_pair_object requires `private_key_pem`\"\n                    )));\n                }\n                if has_password {\n                    return Err(SinkError::Config(anyhow!(\n                        \"auth.method=key_pair_object must not set `password`\"\n                    )));\n                }\n                AUTH_METHOD_KEY_PAIR_OBJECT.to_owned()\n            }\n            Some(other) => {\n                return Err(SinkError::Config(anyhow!(\n                    \"invalid auth.method: {} (allowed: password | key_pair_file | key_pair_object)\",\n                    other\n                )));\n            }\n            None => {\n                // Infer auth method from supplied fields\n                match (has_password, has_file, has_pem) {\n                    (true, false, false) => AUTH_METHOD_PASSWORD.to_owned(),\n                    (false, true, false) => AUTH_METHOD_KEY_PAIR_FILE.to_owned(),\n                    (false, false, true) => AUTH_METHOD_KEY_PAIR_OBJECT.to_owned(),\n                    (true, true, _) | (true, _, true) | (false, true, true) => {","sourceCodeStart":301,"sourceCodeEnd":337,"githubUrl":"https://github.com/risingwavelabs/risingwave/blob/6469eb736d691e8e9b8a419a57edd6429ca77417/src/connector/src/sink/snowflake_redshift/snowflake.rs#L301-L337","documentation":"The Snowflake sink connector validates the auth configuration parsed from the user's WITH options map. When `auth.method` is explicitly set to `key_pair_object`, the key-pair authentication path is used, which authenticates with a private key (supplied inline as `private_key_pem`); a `password` would conflict with that mechanism, so the connector refuses the combination at sink creation time.","triggerScenarios":"Calling the sink `from_btreemap` constructor (via CREATE SINK) with options containing `auth.method = 'key_pair_object'` AND a `password` entry at the same time.","commonSituations":"Copy-pasting an old password-based sink definition and only adding `auth.method='key_pair_object'` (or switching auth methods during a security migration) without removing the leftover `password` option.","solutions":["Remove the `password` option from the sink's WITH clause.","Keep `auth.method='key_pair_object'` and supply `private_key_pem` (and `private_key_passphrase` if the key is encrypted).","If password auth is actually intended, set `auth.method='password'` instead and keep the password."],"exampleFix":"// before\nWITH (\n  connector = 'snowflake',\n  auth.method = 'key_pair_object',\n  password = 'mypassword',\n  private_key_pem = '...'\n)\n// after\nWITH (\n  connector = 'snowflake',\n  auth.method = 'key_pair_object',\n  private_key_pem = '...'\n)","handlingStrategy":"validation","validationCode":"const opts = { 'auth.method': 'key_pair_object', password: 'x' };\nif (opts['auth.method'] === 'key_pair_object' && opts.password) {\n  throw new Error('Remove `password` when auth.method=key_pair_object');\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep exactly one auth mechanism per sink definition.","Remove old `password` options immediately when migrating to key-pair auth.","Use a shared DDL template with mutually exclusive auth branches."],"tags":["snowflake","sink","authentication","config"],"backgroundTag":"conflicting-config-options","analyzedSha":"6469eb736d691e8e9b8a419a57edd6429ca77417","analyzedAt":"2026-09-11T21:06:21.487Z","contentChangedAt":"2026-09-11T21:06:21.487Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}