{"record":{"id":"1aea296bc85f6b25","repo":"apache/beam","slug":"exactly-one-authentication-method-must-be-configured","errorCode":null,"errorMessage":"Exactly one authentication method must be configured: password, oauthToken, or privateKey.","messagePattern":"Exactly one authentication method must be configured: password, oauthToken, or privateKey\\.","errorType":"validation","errorClass":"java.lang.IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"sdks/java/io/snowflake/src/main/java/org/apache/beam/sdk/io/snowflake/SnowflakeSchemaTransformUtils.java","lineNumber":105,"sourceCode":"      @Nullable String privateKey,\n      @Nullable String privateKeyPassphrase) {\n\n    int authenticationMethods = 0;\n\n    if (isNotEmpty(password)) {\n      authenticationMethods++;\n    }\n\n    if (isNotEmpty(oauthToken)) {\n      authenticationMethods++;\n    }\n\n    if (isNotEmpty(privateKey)) {\n      authenticationMethods++;\n    }\n\n    if (authenticationMethods != 1) {\n      throw new IllegalArgumentException(\n          \"Exactly one authentication method must be configured: \"\n              + \"password, oauthToken, or privateKey.\");\n    }\n\n    if ((isNotEmpty(password) || isNotEmpty(privateKey)) && !isNotEmpty(username)) {\n      throw new IllegalArgumentException(\n          \"username is required for password and private key authentication.\");\n    }\n\n    if (isNotEmpty(privateKeyPassphrase) && !isNotEmpty(privateKey)) {\n      throw new IllegalArgumentException(\"privateKeyPassphrase requires privateKey.\");\n    }\n  }\n\n  @EnsuresNonNullIf(expression = \"#1\", result = true)\n  public static boolean isNotEmpty(@Nullable String value) {\n    return value != null && !value.isEmpty();\n  }","sourceCodeStart":87,"sourceCodeEnd":123,"githubUrl":"https://github.com/apache/beam/blob/12126d8942aaf848030c478b4c6a28c6af861c66/sdks/java/io/snowflake/src/main/java/org/apache/beam/sdk/io/snowflake/SnowflakeSchemaTransformUtils.java#L87-L123","documentation":"SnowflakeSchemaTransformUtils.validateAuthentication counts the configured authentication methods (password, oauthToken, privateKey) and throws IllegalArgumentException when the count is not exactly 1. Snowflake sinks/reads in schema-transform form require precisely one auth mechanism.","triggerScenarios":"Setting zero auth options (all null/empty), or two+ of password, oauthToken, privateKey simultaneously.","commonSituations":"Providing both password and privateKey during a migration from password to key-pair auth; empty-string values counted/ignored inconsistently; defaults injected by the runner plus user-supplied options.","solutions":["Keep exactly one of: password, oauthToken, or privateKey — remove the others.","If migrating to key-pair auth, clear the password field.","Ensure empty strings are nulled out rather than passed as \"\".","Verify option-precedence code isn't copying multiple secrets from a secret manager into the config."],"exampleFix":"// before\nbuilder.setPassword(pw).setPrivateKey(pem); // two methods\n// after\nbuilder.setPrivateKey(pem);","handlingStrategy":"validation","validationCode":"int methods = 0;\nif (isNotEmpty(password)) methods++;\nif (isNotEmpty(oauthToken)) methods++;\nif (isNotEmpty(privateKey)) methods++;\nif (methods != 1) throw new IllegalArgumentException(\"Configure exactly one of password, oauthToken, privateKey\");","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Configure exactly one auth method; null out the rest when migrating.","Treat empty strings as absent in config loading.","Avoid defaults that inject extra credentials."],"tags":["java","snowflake","authentication","validation"],"backgroundTag":"missing-credentials","analyzedSha":"12126d8942aaf848030c478b4c6a28c6af861c66","analyzedAt":"2026-09-13T01:50:10.254Z","contentChangedAt":"2026-09-13T01:50:10.254Z","schemaVersion":2},"datasetVersion":"2026-09-20T03:17:13.778Z"}