{"record":{"id":"5805d8c3c654f3de","repo":"risingwavelabs/risingwave","slug":"please-set-the-password-when-the-username-is-set","errorCode":null,"errorMessage":"please set the password when the username is set.","messagePattern":"please set the password when the username is set\\.","errorType":"validation","errorClass":"SinkError::Config","httpStatus":null,"severity":"error","filePath":"src/connector/src/sink/elasticsearch_opensearch/elasticsearch_opensearch_config.rs","lineNumber":193,"sourceCode":"            serde_json::from_value::<OpenSearchConfig>(serde_json::to_value(properties).unwrap())\n                .map_err(|e| SinkError::Config(anyhow!(e)))?;\n        Ok(config)\n    }\n}\n\nimpl ElasticSearchOpenSearchConfig {\n    pub fn from_btreemap(properties: BTreeMap<String, String>) -> Result<Self> {\n        let config = serde_json::from_value::<ElasticSearchOpenSearchConfig>(\n            serde_json::to_value(properties).unwrap(),\n        )\n        .map_err(|e| SinkError::Config(anyhow!(e)))?;\n        Ok(config)\n    }\n\n    pub fn build_client(&self, connector: &str) -> Result<ElasticSearchOpenSearchClient> {\n        let check_username_password = || -> Result<()> {\n            if self.username.is_some() && self.password.is_none() {\n                return Err(SinkError::Config(anyhow!(\n                    \"please set the password when the username is set.\"\n                )));\n            }\n            if self.username.is_none() && self.password.is_some() {\n                return Err(SinkError::Config(anyhow!(\n                    \"please set the username when the password is set.\"\n                )));\n            }\n            Ok(())\n        };\n        let url =\n            Url::parse(&self.url).map_err(|e| SinkError::ElasticSearchOpenSearch(anyhow!(e)))?;\n        if connector.eq(ES_SINK) {\n            let mut transport_builder = elasticsearch::http::transport::TransportBuilder::new(\n                elasticsearch::http::transport::SingleNodeConnectionPool::new(url),\n            );\n            if let Some(username) = &self.username\n                && let Some(password) = &self.password","sourceCodeStart":175,"sourceCodeEnd":211,"githubUrl":"https://github.com/risingwavelabs/risingwave/blob/6469eb736d691e8e9b8a419a57edd6429ca77417/src/connector/src/sink/elasticsearch_opensearch/elasticsearch_opensearch_config.rs#L175-L211","documentation":"build_client validates that credentials come in pairs: when a username is configured but no password, constructing HTTP Basic auth would be incomplete, so client creation is rejected with this config error.","triggerScenarios":"Creating an Elasticsearch/OpenSearch sink (or connection) whose config has `username` set but `password` unset; build_client is called by new during sink creation.","commonSituations":"Omitting the password line from the WITH clause; password supplied via a secret/environment variable that resolved to nothing; copy-paste that dropped the password key.","solutions":["Add the matching `password` alongside `username` in the sink/connection options.","If the endpoint allows anonymous access, remove both username and password.","Verify referenced secrets resolve to non-empty values."],"exampleFix":"// before\nWITH (\n  'connector' = 'elasticsearch',\n  'url' = 'https://es.example.com:9200',\n  'username' = 'elastic'\n)\n// after\nWITH (\n  'connector' = 'elasticsearch',\n  'url' = 'https://es.example.com:9200',\n  'username' = 'elastic',\n  'password' = 'secret'\n)","handlingStrategy":"validation","validationCode":"-- assert paired credentials before DDL\n-- WITH clause must contain both 'username' and 'password' or neither","typeGuard":null,"tryCatchPattern":"match err { SinkError::Config(e) if e.to_string().contains(\"password when the username\") => add_password_option(), _ => return Err(err) }","preventionTips":["Always write username and password options adjacent to each other in the WITH clause.","Verify secrets resolve to non-empty values before sink creation.","For anonymous clusters, omit both options rather than just one."],"tags":["elasticsearch","opensearch","config","credentials","validation"],"backgroundTag":"missing-credentials","analyzedSha":"6469eb736d691e8e9b8a419a57edd6429ca77417","analyzedAt":"2026-09-11T21:06:21.487Z","contentChangedAt":"2026-09-11T21:06:21.487Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}