{"record":{"id":"0bf2022e5ea29327","repo":"argoproj/argo-workflows","slug":"insufficient-authentication-information-provided","errorCode":null,"errorMessage":"insufficient authentication information provided","messagePattern":"insufficient authentication information provided","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"util/sqldb/session.go","lineNumber":184,"sourceCode":"\n\t\t\treturn fn(newSp)\n\t\t}, opts)\n\t})\n}\n\nfunc (sp *SessionProxy) connect(ctx context.Context) error {\n\tvar sess db.Session\n\tvar err error\n\n\tswitch {\n\tcase sp.kubectlConfig != nil && sp.namespace != \"\" && sp.dbConfig != nil:\n\t\t// Use Kubernetes secrets for authentication\n\t\tsess, _, err = CreateDBSession(ctx, sp.kubectlConfig, sp.namespace, *sp.dbConfig)\n\tcase sp.username != \"\" && sp.password != \"\" && sp.dbConfig != nil:\n\t\t// Use direct credentials\n\t\tsess, _, err = CreateDBSessionWithCreds(*sp.dbConfig, sp.username, sp.password)\n\tdefault:\n\t\treturn fmt.Errorf(\"insufficient authentication information provided\")\n\t}\n\n\tif err != nil {\n\t\treturn err\n\t}\n\n\terr = sess.Ping()\n\tif err != nil {\n\t\treturn err\n\t}\n\tsp.closed = false\n\n\tsp.sess = sess\n\treturn nil\n}\n\nfunc (sp *SessionProxy) isNetworkError(err error) bool {\n\tif err == nil {","sourceCodeStart":166,"sourceCodeEnd":202,"githubUrl":"https://github.com/argoproj/argo-workflows/blob/35bff19146f5a6ada77468c431f2624bd577e373/util/sqldb/session.go#L166-L202","documentation":"SessionProxy.connect dispatches on which credentials are present: Kubernetes-secret auth (kubectlConfig+namespace+dbConfig) or direct credentials (username+password+dbConfig). If none of the switch cases match, it returns \"insufficient authentication information provided\". The SessionProxy was built without enough information to authenticate to the database.","triggerScenarios":"connect() hits the default branch when SessionProxyConfig lacks both (KubectlConfig && Namespace && DBConfig) and (Username && Password && DBConfig) — e.g. DBConfig nil, or username/password partially empty (one of the two set, the other blank), or kubectlConfig nil with empty namespace.","commonSituations":"Constructing SessionProxyConfig in tests/tools with only Username but empty Password; calling NewSessionProxy without a DBConfig; SessionProxyFromConfig passing an empty DBConfig struct pointer logic mismatch; forgetting to load the kubeconfig so kubectlConfig is nil and namespace empty.","solutions":["Provide a complete auth path: set DBConfig plus either (KubectlConfig and Namespace) for secret-based auth, or both Username and Password for direct auth.","Check for partial credentials: an empty Password with a set Username (or vice versa) still falls through — fill both or clear both.","Ensure DBConfig is actually populated (non-nil pointer in the proxy) before calling NewSessionProxy.","If using secret-based auth, load the kubeconfig client and set the namespace where the DB secret lives.","Add pre-call validation of SessionProxyConfig fields to catch this before hitting connect()."],"exampleFix":"// before\nSessionProxyConfig{DBConfig: cfg, Username: \"argo\"} // password empty\n// after\nSessionProxyConfig{DBConfig: cfg, Username: \"argo\", Password: os.Getenv(\"PGPASSWORD\")}","handlingStrategy":"validation","validationCode":"func hasAuthInfo(c SessionProxyConfig) bool {\n    secretPath := c.KubectlConfig != nil && c.Namespace != \"\"\n    directPath := c.Username != \"\" && c.Password != \"\"\n    return (secretPath || directPath) && c.DBConfig != nil\n}","typeGuard":"func hasDirectCreds(c SessionProxyConfig) bool {\n    return c.Username != \"\" && c.Password != \"\"\n}","tryCatchPattern":"if !hasAuthInfo(cfg) {\n    return fmt.Errorf(\"refusing to connect: neither secret-based nor direct credentials configured\")\n}\nif _, err := NewSessionProxy(ctx, cfg); err != nil {\n    if strings.Contains(err.Error(), \"insufficient authentication information\") {\n        log.Fatal(\"DB auth config incomplete: set kubectlConfig+namespace OR username+password\")\n    }\n    return err\n}","preventionTips":["Always set both Username and Password, or use the secret path with a loaded kubeconfig and namespace — never one of a pair.","Unit-test config-to-SessionProxyConfig assembly so empty fields are caught early.","Fail fast in your own config loader when DBConfig is empty.","Document both supported auth paths (secret-based vs direct credentials) for operators."],"tags":["authentication","database","configuration","validation"],"backgroundTag":"missing-db-credentials","analyzedSha":"35bff19146f5a6ada77468c431f2624bd577e373","analyzedAt":"2026-09-03T19:34:35.908Z","contentChangedAt":"2026-09-03T19:34:35.908Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}