{"record":{"id":"3d8668e48bb81bfd","repo":"googleapis/mcp-toolbox","slug":"username-from-adc-cannot-be-an-empty-string","errorCode":null,"errorMessage":"username from ADC cannot be an empty string","messagePattern":"username from ADC cannot be an empty string","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/sources/util.go","lineNumber":140,"sourceCode":"\t\treturn \"\", fmt.Errorf(\"email field is not a string\")\n\t}\n\n\tvar username string\n\t// Format the username based on Database Type\n\tswitch strings.ToLower(dbType) {\n\tcase \"mysql\":\n\t\tusername, _, _ = strings.Cut(fullEmail, \"@\")\n\n\tcase \"postgres\":\n\t\t// service account email used for IAM should trim the suffix\n\t\tusername = strings.TrimSuffix(fullEmail, \".gserviceaccount.com\")\n\n\tdefault:\n\t\treturn \"\", fmt.Errorf(\"unsupported dbType: %s. Use 'mysql' or 'postgres'\", dbType)\n\t}\n\n\tif username == \"\" {\n\t\treturn \"\", fmt.Errorf(\"username from ADC cannot be an empty string\")\n\t}\n\n\treturn username, nil\n}\n\nfunc GetIAMAccessToken(ctx context.Context) (string, error) {\n\tcreds, err := google.FindDefaultCredentials(ctx, \"https://www.googleapis.com/auth/cloud-platform\")\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"failed to find default credentials (run 'gcloud auth application-default login'?): %w\", err)\n\t}\n\n\ttoken, err := creds.TokenSource.Token() // This gets an oauth2.Token\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"failed to get token from token source: %w\", err)\n\t}\n\n\tif !token.Valid() {\n\t\treturn \"\", fmt.Errorf(\"retrieved token is invalid or expired\")","sourceCodeStart":122,"sourceCodeEnd":158,"githubUrl":"https://github.com/googleapis/mcp-toolbox/blob/8cc6e09de2ad7b8bffc77751799585a1401a48eb/internal/sources/util.go#L122-L158","documentation":"After trimming the '.gserviceaccount.com' suffix from the ADC service account email, GetIAMPrincipalEmailFromADC requires a non-empty username. If the resolved ADC credentials have an empty or missing account email, the derived username would be empty and IAM auth would be meaningless, so the library rejects it with this error.","triggerScenarios":"google.FindDefaultCredentials returns credentials whose principal email is empty or absent (e.g. credentials from a metadata source without an account, or ADC JSON lacking client_email) while configuring Cloud SQL IAM auth for mysql/postgres.","commonSituations":"Running locally without 'gcloud auth application-default login' so ADC falls back to a source without an email; a service account key file that is malformed or missing the client_email field; using workload metadata credentials where the service account email is not populated.","solutions":["Run 'gcloud auth application-default login' to set up valid ADC with an associated account","Verify the ADC JSON key file contains a non-empty 'client_email' field","Check GOOGLE_APPLICATION_CREDENTIALS points to a complete service account key file"],"exampleFix":"// before: ADC missing/anonymous\nexport GOOGLE_APPLICATION_CREDENTIALS=/path/to/broken.json\n// after\nexport GOOGLE_APPLICATION_CREDENTIALS=/path/to/service-account-key.json # must contain client_email","handlingStrategy":"validation","validationCode":"import { google } from \"googleapis\";\nconst creds = await google.auth.getApplicationDefault();\nif (!creds.credential?.email || creds.credential.email === \"\") {\n  throw new Error(\"ADC has no service account email; run 'gcloud auth application-default login' or fix the key file\");\n}","typeGuard":"function hasPrincipalEmail(c: { email?: string | null }): c is { email: string } {\n  return typeof c.email === \"string\" && c.email.length > 0;\n}","tryCatchPattern":"try {\n  const email = await getIAMPrincipalEmailFromADC(ctx, dbType);\n} catch (err) {\n  if (String(err).includes(\"username from ADC cannot be an empty string\")) {\n    console.error(\"ADC lacks a service account email; re-run 'gcloud auth application-default login'\");\n  }\n  throw err;\n}","preventionTips":["Run 'gcloud auth application-default login' before starting the toolbox locally","Inspect GOOGLE_APPLICATION_CREDENTIALS key files for a non-empty 'client_email'","Prefer attached service accounts with well-known emails on GCP infrastructure"],"tags":["iam-auth","google-cloud","adc","config"],"backgroundTag":"adc-credentials-missing","analyzedSha":"8cc6e09de2ad7b8bffc77751799585a1401a48eb","analyzedAt":"2026-09-05T01:10:36.887Z","contentChangedAt":"2026-09-05T01:10:36.887Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}