{"record":{"id":"23d2064614ad3804","repo":"SigNoz/signoz","slug":"invalid-input-23d206","errorCode":"invalid_input","errorMessage":"identn::impersonation cannot be enabled if identn::tokenizer is enabled","messagePattern":"identn::impersonation cannot be enabled if identn::tokenizer is enabled","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/identn/config.go","lineNumber":63,"sourceCode":"\treturn &Config{\n\t\tTokenizer: TokenizerConfig{\n\t\t\tEnabled: true,\n\t\t\tHeaders: []string{\"Authorization\", \"Sec-WebSocket-Protocol\"},\n\t\t},\n\t\tAPIKeyConfig: APIKeyConfig{\n\t\t\tEnabled: true,\n\t\t\tHeaders: []string{\"SIGNOZ-API-KEY\"},\n\t\t},\n\t\tImpersonation: ImpersonationConfig{\n\t\t\tEnabled: false,\n\t\t},\n\t}\n}\n\nfunc (c Config) Validate() error {\n\tif c.Impersonation.Enabled {\n\t\tif c.Tokenizer.Enabled {\n\t\t\treturn errors.New(errors.TypeInvalidInput, errors.CodeInvalidInput, \"identn::impersonation cannot be enabled if identn::tokenizer is enabled\")\n\t\t}\n\n\t\tif c.APIKeyConfig.Enabled {\n\t\t\treturn errors.New(errors.TypeInvalidInput, errors.CodeInvalidInput, \"identn::impersonation cannot be enabled if identn::apikey is enabled\")\n\t\t}\n\t}\n\n\treturn nil\n}\n","sourceCodeStart":45,"sourceCodeEnd":73,"githubUrl":"https://github.com/SigNoz/signoz/blob/5069bf80b08f1f00d7e014eccc09902f9871004f/pkg/identn/config.go#L45-L73","documentation":"The identn (identity) Config.Validate rejects enabling impersonation while the tokenizer is also enabled, because the two mechanisms are mutually exclusive ways of resolving request identity.","triggerScenarios":"Setting impersonation.enabled=true and tokenizer.enabled=true in the identn config at startup.","commonSituations":"Copy-pasted config blocks enabling every feature; migrating from tokenizer to impersonation without disabling the old one.","solutions":["Disable identn.tokenizer if you need impersonation","Or disable impersonation if tokenizer is required","Re-run config validation locally (Config.Validate) before deploying"],"exampleFix":"# before\nimpersonation:\n  enabled: true\ntokenizer:\n  enabled: true\n# after\nimpersonation:\n  enabled: true\ntokenizer:\n  enabled: false","handlingStrategy":"validation","validationCode":"if cfg.Impersonation.Enabled && cfg.Tokenizer.Enabled { return cfg.Validate() /* surfaces error early */ }\nreturn cfg.Validate()","typeGuard":null,"tryCatchPattern":"if err := cfg.Validate(); err != nil { log.Fatal(err) }","preventionTips":["Run Config.Validate in unit tests for all config permutations","Disable the replaced identity mechanism when switching"],"tags":["configuration","startup","identity","mutually-exclusive"],"backgroundTag":"invalid-configuration","analyzedSha":"5069bf80b08f1f00d7e014eccc09902f9871004f","analyzedAt":"2026-08-28T06:22:12.824Z","schemaVersion":2},"datasetVersion":"2026-08-28T11:17:15.048Z"}