{"record":{"id":"07b710d7e8bff1e0","repo":"risingwavelabs/risingwave","slug":"auth-method-key-pair-file-must-not-set-password","errorCode":null,"errorMessage":"auth.method=key_pair_file must not set `password`","messagePattern":"auth\\.method=key_pair_file must not set `password`","errorType":"validation","errorClass":"SinkError::Config","httpStatus":null,"severity":"error","filePath":"src/connector/src/sink/snowflake_redshift/snowflake.rs","lineNumber":301,"sourceCode":"                    return Err(SinkError::Config(anyhow!(\n                        \"auth.method=password requires `password`\"\n                    )));\n                }\n                if has_file || has_pem {\n                    return Err(SinkError::Config(anyhow!(\n                        \"auth.method=password must not set `private_key_file`/`private_key_pem`\"\n                    )));\n                }\n                AUTH_METHOD_PASSWORD.to_owned()\n            }\n            Some(method) if method == AUTH_METHOD_KEY_PAIR_FILE => {\n                if !has_file {\n                    return Err(SinkError::Config(anyhow!(\n                        \"auth.method=key_pair_file requires `private_key_file`\"\n                    )));\n                }\n                if has_password {\n                    return Err(SinkError::Config(anyhow!(\n                        \"auth.method=key_pair_file must not set `password`\"\n                    )));\n                }\n                if has_pem {\n                    return Err(SinkError::Config(anyhow!(\n                        \"auth.method=key_pair_file must not set `private_key_pem`\"\n                    )));\n                }\n                AUTH_METHOD_KEY_PAIR_FILE.to_owned()\n            }\n            Some(method) if method == AUTH_METHOD_KEY_PAIR_OBJECT => {\n                if !has_pem {\n                    return Err(SinkError::Config(anyhow!(\n                        \"auth.method=key_pair_object requires `private_key_pem`\"\n                    )));\n                }\n                if has_password {\n                    return Err(SinkError::Config(anyhow!(","sourceCodeStart":283,"sourceCodeEnd":319,"githubUrl":"https://github.com/risingwavelabs/risingwave/blob/6469eb736d691e8e9b8a419a57edd6429ca77417/src/connector/src/sink/snowflake_redshift/snowflake.rs#L283-L319","documentation":"Key-pair file authentication must not also carry a password credential. from_btreemap rejects `auth.method = 'key_pair_file'` combined with a `password` option to keep a single unambiguous auth method.","triggerScenarios":"CREATE SINK with `auth.method = 'key_pair_file'` and `private_key_file` set, but `password` also present in the WITH options.","commonSituations":"Connection templates that always include a password placeholder; leftover password option after migrating from password auth to key-pair auth.","solutions":["Remove the `password` option from the WITH clause","Or change `auth.method` to 'password' if password auth is intended"],"exampleFix":"// before\nWITH (connector='snowflake', auth.method='key_pair_file', private_key_file='/keys/rsa.p8', password='***');\n// after\nWITH (connector='snowflake', auth.method='key_pair_file', private_key_file='/keys/rsa.p8');","handlingStrategy":"validation","validationCode":"if auth_method == \"key_pair_file\" && options.contains_key(\"password\") {\n    return Err(\"key_pair_file auth conflicts with password\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Remove password placeholders when adopting key-pair auth","Rotate to a single auth method per sink and document it","Review generated configs for stale credentials"],"tags":["snowflake","sink","auth","config-validation"],"backgroundTag":"mutually-exclusive-options","analyzedSha":"6469eb736d691e8e9b8a419a57edd6429ca77417","analyzedAt":"2026-09-11T21:06:21.487Z","contentChangedAt":"2026-09-11T21:06:21.487Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}