{"record":{"id":"130aede686b92c81","repo":"googleapis/mcp-toolbox","slug":"password-is-provided-without-a-username-please-pr","errorCode":null,"errorMessage":"password is provided without a username. Please provide both a username and password, or leave both fields empty","messagePattern":"password is provided without a username\\. Please provide both a username and password, or leave both fields empty","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/sources/alloydbpg/alloydb_pg.go","lineNumber":188,"sourceCode":"\nfunc getConnectionConfig(ctx context.Context, user, pass, dbname string, readOnly bool) (string, bool, error) {\n\tuserAgent, err := util.UserAgentFromContext(ctx)\n\tif err != nil {\n\t\tuserAgent = \"genai-toolbox\"\n\t}\n\tuseIAM := true\n\n\tvar dsn string\n\t// If username and password both provided, use password authentication\n\tif user != \"\" && pass != \"\" {\n\t\tdsn = fmt.Sprintf(passwordDSNFormat, user, pass, dbname, userAgent)\n\t\tuseIAM = false\n\t} else if user == \"\" {\n\t\t// If username is empty, fetch email from ADC\n\t\t// otherwise, use username as IAM email\n\t\tif pass != \"\" {\n\t\t\t// If password is provided without an username, raise an error\n\t\t\treturn \"\", useIAM, fmt.Errorf(\"password is provided without a username. Please provide both a username and password, or leave both fields empty\")\n\t\t}\n\t\temail, err := sources.GetIAMPrincipalEmailFromADC(ctx, \"postgres\")\n\t\tif err != nil {\n\t\t\treturn \"\", useIAM, fmt.Errorf(\"error getting email from ADC: %v\", err)\n\t\t}\n\t\tuser = email\n\t\tdsn = fmt.Sprintf(iamDSNFormat, user, dbname, userAgent)\n\t} else {\n\t\t// Construct IAM connection string with username\n\t\tdsn = fmt.Sprintf(iamDSNFormat, user, dbname, userAgent)\n\t}\n\n\tif readOnly {\n\t\t// IMPORTANT: Must use underscore ('alloydb_session_read_only'), NOT a dot.\n\t\t// PostgreSQL treats dotted GUCs (e.g. 'alloydb.session_read_only') as custom placeholders\n\t\t// and silently ignores them at connection time, leaving the session in read-write mode.\n\t\tdsn += \" options='-c alloydb_session_read_only=locked'\"\n\t}","sourceCodeStart":170,"sourceCodeEnd":206,"githubUrl":"https://github.com/googleapis/mcp-toolbox/blob/8cc6e09de2ad7b8bffc77751799585a1401a48eb/internal/sources/alloydbpg/alloydb_pg.go#L170-L206","documentation":"getConnectionConfig implements AlloyDB's auth rules: either both username and password (built-in Postgres auth) or neither (IAM auth, where the username is derived from Application Default Credentials). Providing a password with no username is ambiguous/invalid, so it returns this error before any connection attempt.","triggerScenarios":"Configuring an alloydb-postgres source with `password` set but `user` empty, without IAM auth intent — detected while resolving connection config during pool initialization.","commonSituations":"Users setting only a password assuming a default user, or intending IAM auth but supplying a password (IAM auth requires the password field to be empty).","solutions":["Provide both user and password for built-in authentication.","Or remove the password and leave both empty to use IAM auth with ADC.","If using IAM auth, ensure the ADC principal is granted as a database user on the instance.","Validate the source YAML so password is never set without user."],"exampleFix":"// before\nsources:\n  db:\n    kind: alloydb-postgres\n    password: secret   # user missing\n// after\nsources:\n  db:\n    kind: alloydb-postgres\n    user: app-user\n    password: secret","handlingStrategy":"validation","validationCode":"// Validate auth pair before writing/loading source config\nfunc validAuthConfig(user, password string) error {\n    if password != \"\" && user == \"\" {\n        return fmt.Errorf(\"password requires a user; provide both or neither (IAM auth)\")\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":"src, err := cfg.Initialize(ctx, tracer)\nif err != nil && strings.Contains(err.Error(), \"password is provided without a username\") {\n    return fmt.Errorf(\"source auth misconfigured: set both user and password, or neither for IAM auth: %w\", err)\n}","preventionTips":["Always pair password with a username in configs","Use IAM auth by omitting both user and password","Add config linting that checks user/password pairing","Document the auth rules (both-or-neither) in deployment runbooks"],"tags":["go","configuration","authentication","alloydb","validation"],"backgroundTag":"missing-username-with-password","analyzedSha":"8cc6e09de2ad7b8bffc77751799585a1401a48eb","analyzedAt":"2026-09-05T01:10:36.887Z","contentChangedAt":"2026-09-05T01:10:36.887Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}