{"record":{"id":"2345fd376e60d92a","repo":"cube-js/cube","slug":"incorrect-user-name-user-or-password","errorCode":null,"errorMessage":"Incorrect user name \"${user}\" or password","messagePattern":"Incorrect user name \"(.+?)\" or password","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/cubejs-api-gateway/src/sql-server.ts","lineNumber":365,"sourceCode":"        allowedUser = 'cube';\n\n        displayCLIWarning(\n          'Option sqlUser is required in production mode. Cube.js will use \\'cube\\' as a default username.'\n        );\n      }\n\n      if (!allowedPassword) {\n        allowedPassword = crypto.randomBytes(16).toString('hex');\n\n        displayCLIWarning(\n          `Option sqlPassword is required in production mode. Cube.js has generated it as '${allowedPassword}'`\n        );\n      }\n    }\n\n    return async (req, user) => {\n      if (allowedUser && user !== allowedUser) {\n        throw new Error(`Incorrect user name \"${user}\" or password`);\n      }\n\n      return {\n        password: allowedPassword,\n        securityContext: {},\n        skipPasswordCheck: getEnv('devMode') && !allowedPassword\n      };\n    };\n  }\n\n  protected async contextByNativeReq(req: NativeRequest<LoadRequestMeta>, securityContext, requestId: string): Promise<ExtendedRequestContext> {\n    const context = await this.apiGateway.contextByReq(<any> req, securityContext, requestId);\n\n    return {\n      ...context,\n      ...req.meta,\n    };\n  }","sourceCodeStart":347,"sourceCodeEnd":383,"githubUrl":"https://github.com/cube-js/cube/blob/7d981676b36392fec34088b9afab6bdcad40207c/packages/cubejs-api-gateway/src/sql-server.ts#L347-L383","documentation":"When no custom checkSqlAuth is provided, SQLServer builds a default auth function that accepts a single fixed user/password from options (sqlUser/sqlPassword or sqlSuperUser). If the SQL client authenticates with a username different from the allowed one, the default function throws 'Incorrect user name \"<user>\" or password'. It is the Postgres/SQL-API analogue of a failed login.","triggerScenarios":"Connecting to Cube's SQL API with a username other than the configured sqlUser (or sqlSuperUser when connecting on the superuser port), e.g. typing 'postgres' or an OS username into the SQL client's user field.","commonSituations":"BI tools defaulting the username to the OS user or 'postgres'; reusing database credentials instead of the Cube SQL credentials; after rotating sqlPassword/sqlUser in options or env without updating clients; connecting with a JWT-expected flow while the default static auth is configured.","solutions":["Set the SQL client username to the configured sqlUser (or sqlSuperUser) value, e.g. CUBEJS_SQL_USER.","Verify the password matches CUBEJS_SQL_PASSWORD / options.sqlPassword for that user.","Provide a custom checkSqlAuth function if dynamic per-user credentials or JWT-based SQL auth is required."],"exampleFix":"// before\npsql -h localhost -p 15432 -U postgres -d cube\n// after (CUBEJS_SQL_USER=cube)\npsql -h localhost -p 15432 -U cube -d cube","handlingStrategy":"validation","validationCode":"const expectedUser = process.env.CUBEJS_SQL_USER; // or options.sqlUser\nif (sqlClientUser !== expectedUser) {\n  throw new Error(`SQL client user must be \"${expectedUser}\", got \"${sqlClientUser}\"`);\n}","typeGuard":"null","tryCatchPattern":"try {\n  await connectToCubeSql({ user: CUBEJS_SQL_USER, password: CUBEJS_SQL_PASSWORD });\n} catch (e) {\n  if (e.message.includes('Incorrect user name')) {\n    console.error(`Wrong SQL credentials: ${e.message}; check CUBEJS_SQL_USER/CUBEJS_SQL_PASSWORD`);\n  } else throw e;\n}","preventionTips":["Store CUBEJS_SQL_USER and CUBEJS_SQL_PASSWORD in env and use them verbatim in clients.","Never reuse database (Postgres) credentials for the Cube SQL API.","Rotate credentials simultaneously in server config and all BI tool connections.","Implement custom checkSqlAuth if you need dynamic users/JWT-based SQL auth."],"tags":["auth","sql","credentials"],"backgroundTag":"sql-authentication-failed","analyzedSha":"7d981676b36392fec34088b9afab6bdcad40207c","analyzedAt":"2026-09-02T03:45:10.400Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}