{"record":{"id":"3f591ebc8b624645","repo":"googleapis/mcp-toolbox","slug":"error-getting-email-from-adc-v","errorCode":null,"errorMessage":"error getting email from ADC: %v","messagePattern":"error getting email from ADC: (.+?)","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/sources/alloydbpg/alloydb_pg.go","lineNumber":192,"sourceCode":"\t\tuserAgent = \"genai-toolbox\"\n\t}\n\tuseIAM := true\n\n\tvar dsn string\n\t// If username and password both provided, use password authentication\n\tif user != \"\" && pass != \"\" {\n\t\tdsn = fmt.Sprintf(passwordDSNFormat, user, pass, dbname, userAgent)\n\t\tuseIAM = false\n\t} else if user == \"\" {\n\t\t// If username is empty, fetch email from ADC\n\t\t// otherwise, use username as IAM email\n\t\tif pass != \"\" {\n\t\t\t// If password is provided without an username, raise an error\n\t\t\treturn \"\", useIAM, fmt.Errorf(\"password is provided without a username. Please provide both a username and password, or leave both fields empty\")\n\t\t}\n\t\temail, err := sources.GetIAMPrincipalEmailFromADC(ctx, \"postgres\")\n\t\tif err != nil {\n\t\t\treturn \"\", useIAM, fmt.Errorf(\"error getting email from ADC: %v\", err)\n\t\t}\n\t\tuser = email\n\t\tdsn = fmt.Sprintf(iamDSNFormat, user, dbname, userAgent)\n\t} else {\n\t\t// Construct IAM connection string with username\n\t\tdsn = fmt.Sprintf(iamDSNFormat, user, dbname, userAgent)\n\t}\n\n\tif readOnly {\n\t\t// IMPORTANT: Must use underscore ('alloydb_session_read_only'), NOT a dot.\n\t\t// PostgreSQL treats dotted GUCs (e.g. 'alloydb.session_read_only') as custom placeholders\n\t\t// and silently ignores them at connection time, leaving the session in read-write mode.\n\t\tdsn += \" options='-c alloydb_session_read_only=locked'\"\n\t}\n\n\treturn dsn, useIAM, nil\n}\n","sourceCodeStart":174,"sourceCodeEnd":210,"githubUrl":"https://github.com/googleapis/mcp-toolbox/blob/8cc6e09de2ad7b8bffc77751799585a1401a48eb/internal/sources/alloydbpg/alloydb_pg.go#L174-L210","documentation":"This error wraps a failure from sources.GetIAMPrincipalEmailFromADC, which uses Application Default Credentials (ADC) to resolve the IAM principal email of the ambient identity for AlloyDB IAM database authentication. When ADC cannot be obtained or cannot be exchanged for the principal email (missing credentials, bad quota project, disabled IAM APIs, revoked token), the source refuses to build the IAM DSN and returns this wrapped error. It is thrown from getConnectionConfig when neither username nor password is supplied, so IAM auth is implied.","triggerScenarios":"Calling Initialize for the alloydbpg source with an empty user and empty pass (implying IAM auth) while Application Default Credentials are unavailable or unusable: GOOGLE_APPLICATION_CREDENTIALS points to a missing/invalid file, no gcloud ADC has been set up (gcloud auth application-default login never run), running on a machine with no metadata server, or the resolved credentials lack permission to get the IAM principal email.","commonSituations":"Local development without 'gcloud auth application-default login'; deploying to an environment where the service account is not attached (VM without scopes, Cloud Run without service account); CI pipelines with no credentials mounted; GOOGLE_APPLICATION_CREDENTIALS pointing to a service-account key that was deleted or rotated away; using a workload identity that lacks roles/serviceusage.serviceUsageConsumer or AlloyDB access.","solutions":["Run 'gcloud auth application-default login' locally, or set GOOGLE_APPLICATION_CREDENTIALS to a valid service-account key JSON.","Verify the runtime environment has an attached service account (VM service account, Cloud Run/Functions runtime SA) when relying on ambient credentials.","Ensure the identity has the IAM roles needed to resolve its email and connect to the AlloyDB instance (e.g. roles/alloydb.client, roles/serviceusage.serviceUsageConsumer).","Alternatively, explicitly provide both a username and password in the source config to bypass the ADC-based IAM path.","Check network access to the OAuth2/metadata endpoints (e.g. metadata.google.internal, oauth2.googleapis.com) from your environment."],"exampleFix":"// before (IAM auth implied, no credentials available)\n{\"user\": \"\", \"pass\": \"\", ...}\n// after: either log in locally\n$ gcloud auth application-default login\n// or provide explicit credentials\n{\"user\": \"myuser\", \"pass\": \"mypassword\", ...}","handlingStrategy":"validation","validationCode":"cred, err := google.FindDefaultCredentials(ctx)\nif err != nil {\n    return fmt.Errorf(\"ADC not available: %w; run 'gcloud auth application-default login'\", err)\n}","typeGuard":null,"tryCatchPattern":"email, err := sources.GetIAMPrincipalEmailFromADC(ctx, \"postgres\")\nif err != nil {\n    log.Printf(\"IAM auth unavailable (%v); falling back to user/pass auth\", err)\n    return nil, err\n}","preventionTips":["Run 'gcloud auth application-default login' in every dev environment and document it in onboarding.","Set GOOGLE_APPLICATION_CREDENTIALS explicitly in CI/deploy configs and verify the key file exists at startup.","Attach a service account to compute environments (GCE, Cloud Run) instead of relying on user ADC.","Pre-flight check credentials with 'gcloud auth application-default print-access-token' before deploying."],"tags":["gcp","authentication","alloydb","iam"],"backgroundTag":"missing-application-default-credentials","analyzedSha":"8cc6e09de2ad7b8bffc77751799585a1401a48eb","analyzedAt":"2026-09-05T01:10:36.887Z","contentChangedAt":"2026-09-05T01:10:36.887Z","schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}