{"record":{"id":"790c33aef14118fd","repo":"apache/druid","slug":"specify-only-one-of-s-or-s","errorCode":null,"errorMessage":"Specify only one of %s or %s","messagePattern":"Specify only one of (.+?) or (.+?)","errorType":"exception","errorClass":"ISE","httpStatus":null,"severity":"error","filePath":"server/src/main/java/org/apache/druid/catalog/model/table/HttpInputSourceDefn.java","lineNumber":338,"sourceCode":"\n  }\n\n  /**\n   * Convert the user name and password. All are SQL strings. Passwords must be in\n   * the form of a password provider, so do the needed conversion. HTTP provides\n   * two kinds of passwords (plain test an reference to an env var), but at most\n   * one can be provided.\n   */\n  private void convertUserPasswordArgs(Map<String, Object> jsonMap, Map<String, Object> args)\n  {\n    String user = CatalogUtils.getString(args, USER_PARAMETER);\n    if (user != null) {\n      jsonMap.put(USERNAME_FIELD, user);\n    }\n    String password = CatalogUtils.getString(args, PASSWORD_PARAMETER);\n    String passwordEnvVar = CatalogUtils.getString(args, PASSWORD_ENV_VAR_PARAMETER);\n    if (password != null && passwordEnvVar != null) {\n      throw new ISE(\n          \"Specify only one of %s or %s\",\n          PASSWORD_PARAMETER,\n          PASSWORD_ENV_VAR_PARAMETER\n      );\n    }\n    if (password != null) {\n      jsonMap.put(\n          PASSWORD_FIELD,\n          ImmutableMap.of(\"type\", DefaultPasswordProvider.TYPE_KEY, \"password\", password)\n      );\n    } else if (passwordEnvVar != null) {\n      jsonMap.put(\n          PASSWORD_FIELD,\n          ImmutableMap.of(\"type\", EnvironmentVariablePasswordProvider.TYPE_KEY, \"variable\", passwordEnvVar)\n      );\n    }\n  }\n}","sourceCodeStart":320,"sourceCodeEnd":356,"githubUrl":"https://github.com/apache/druid/blob/9b90983fd291f26935af934383ce360473179e4d/server/src/main/java/org/apache/druid/catalog/model/table/HttpInputSourceDefn.java#L320-L356","documentation":"HttpInputSourceDefn rejects HTTP input source configs that supply both a plain-text password and a password environment variable. The Druid catalog table definition converts user-supplied args into an input source JSON map and requires exactly one password mechanism so credentials are unambiguous. Thrown as IllegalStateException during arg conversion.","triggerScenarios":"Calling convertArgsToSourceMap or convertCompletedTable on an HTTP input source table whose args contain non-null values for both the password parameter and the password-env-var parameter.","commonSituations":"A developer pastes an example config that uses an env var but leaves the old literal password key in place; migration from literal credentials to env-var credentials without deleting the old field; templated configs where both keys are rendered non-empty.","solutions":["Remove either the password parameter or the passwordEnvVar parameter from the table args, keeping exactly one","Prefer the env-var form for security and delete the literal password","If config is templated, guard so only one of the two keys is ever emitted"],"exampleFix":"// before\nargs: {\"user\":\"u\", \"password\":\"secret\", \"passwordEnvVar\":\"HTTP_PW\"}\n// after\nargs: {\"user\":\"u\", \"passwordEnvVar\":\"HTTP_PW\"}","handlingStrategy":"validation","validationCode":"if (args.containsKey(\"password\") && args.containsKey(\"passwordEnvVar\")\n    && args.get(\"password\") != null && args.get(\"passwordEnvVar\") != null) {\n  throw new IllegalArgumentException(\"Set only one of password or passwordEnvVar\");\n}","typeGuard":null,"tryCatchPattern":"try { defn.convertArgsToSourceMap(args); } catch (IllegalStateException e) { if (e.getMessage().contains(\"Specify only one of\")) { /* fix config: drop one credential key */ } else { throw e; } }","preventionTips":["Standardize on one credential mechanism (prefer passwordEnvVar)","In templates, emit password and passwordEnvVar conditionally, never both","Lint table args for both keys before submission"],"tags":["http","input-source","configuration","mutually-exclusive"],"backgroundTag":"mutually-exclusive-flags","analyzedSha":"9b90983fd291f26935af934383ce360473179e4d","analyzedAt":"2026-09-07T13:32:30.957Z","contentChangedAt":"2026-09-07T13:32:30.957Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}