{"record":{"id":"2cdbdeb09cf0f6c8","repo":"googleapis/mcp-toolbox","slug":"invalid-scylladb-configuration-password-provided","errorCode":null,"errorMessage":"invalid ScyllaDB configuration: password provided without a username","messagePattern":"invalid ScyllaDB configuration: password provided without a username","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/sources/scylladb/scylladb.go","lineNumber":143,"sourceCode":"\t\tout = append(out, row)\n\t}\n\n\tif err := iter.Close(); err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to execute ScyllaDB query: %w\", err)\n\t}\n\treturn out, nil\n}\n\nvar _ sources.Source = &Source{}\n\nfunc initScyllaDBSession(ctx context.Context, tracer trace.Tracer, c Config) (*gocql.Session, error) {\n\t//nolint:all // Reassigned ctx\n\tctx, span := sources.InitConnectionSpan(ctx, tracer, SourceType, c.Name)\n\tdefer span.End()\n\n\t// Validate authentication configuration\n\tif c.Password != \"\" && c.Username == \"\" {\n\t\treturn nil, fmt.Errorf(\"invalid ScyllaDB configuration: password provided without a username\")\n\t}\n\n\tcluster := gocql.NewCluster(c.Hosts...)\n\tcluster.ProtoVersion = c.ProtoVersion\n\tcluster.Keyspace = c.Keyspace\n\tcluster.DisableInitialHostLookup = c.DisableInitialHostLookup\n\n\t// Configure DC-aware token-aware host selection policy.\n\t// This is required for ScyllaDB Cloud and recommended for all multi-DC\n\t// deployments to ensure queries are routed to the correct datacenter.\n\tif c.LocalDC != \"\" {\n\t\tcluster.PoolConfig.HostSelectionPolicy = gocql.TokenAwareHostPolicy(\n\t\t\tgocql.DCAwareRoundRobinPolicy(c.LocalDC),\n\t\t)\n\t}\n\n\t// Configure authentication if username is provided\n\tif c.Username != \"\" {","sourceCodeStart":125,"sourceCodeEnd":161,"githubUrl":"https://github.com/googleapis/mcp-toolbox/blob/8cc6e09de2ad7b8bffc77751799585a1401a48eb/internal/sources/scylladb/scylladb.go#L125-L161","documentation":"initScyllaDBSession validates authentication configuration before building the gocql cluster config. Providing a password without a username is rejected eagerly because gocql/CQL auth requires both an identity and a credential. This is a pure config validation error thrown before any network I/O.","triggerScenarios":"A ScyllaDB source config sets `password` to a non-empty string while `username` is empty or omitted; Initialize → initScyllaDBSession returns this error immediately.","commonSituations":"Copy-pasting configs where only the password placeholder was filled; assuming password-only auth (Cassandra/ScyllaDB always requires a username, typically `cassandra` by default); YAML typo like `user:` instead of `username:` leaving username empty.","solutions":["Add the matching `username` field (default ScyllaDB superuser is `cassandra`).","If the server does not require auth, remove the `password` field entirely instead of leaving username blank.","Check YAML key spelling — it must be `username`, not `user` or `login`."],"exampleFix":"// before\nsources:\n  scylla:\n    kind: scylladb\n    hosts: [\"scylla:9042\"]\n    password: secret\n// after\nsources:\n  scylla:\n    kind: scylladb\n    hosts: [\"scylla:9042\"]\n    username: cassandra\n    password: secret","handlingStrategy":"validation","validationCode":"// Guard: password requires username (mirrors toolbox validation)\nfunction validateScyllaConfig(cfg) {\n  if (cfg.password && !cfg.username) {\n    throw new Error('scylladb: password provided without username');\n  }\n}","typeGuard":"function hasPasswordWithoutUsername(cfg) {\n  return typeof cfg.password === 'string' && cfg.password.length > 0 &&\n         (typeof cfg.username !== 'string' || cfg.username.length === 0);\n}","tryCatchPattern":null,"preventionTips":["Always set username and password together from the same secret store.","Use the exact YAML keys `username` and `password` — `user:` silently leaves username empty.","If auth is disabled on the cluster, omit both fields rather than only the username.","Lint deployment configs for this invariant before rollout."],"tags":["scylladb","config","validation","authentication"],"backgroundTag":"missing-required-argument","analyzedSha":"8cc6e09de2ad7b8bffc77751799585a1401a48eb","analyzedAt":"2026-09-05T01:10:36.887Z","contentChangedAt":"2026-09-05T01:10:36.887Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}