{"record":{"id":"7caf210001ba9b7d","repo":"googleapis/mcp-toolbox","slug":"useclientoauth-cannot-be-used-with-impersonateserv","errorCode":null,"errorMessage":"useClientOAuth cannot be used with impersonateServiceAccount","messagePattern":"useClientOAuth cannot be used with impersonateServiceAccount","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/sources/bigquery/bigquery.go","lineNumber":174,"sourceCode":"\t\tif *r.ReadOnly != isReadOnlyMode {\n\t\t\treturn nil, fmt.Errorf(\"conflicting source configuration: readOnly is %v, but writeMode is %q\", *r.ReadOnly, r.WriteMode)\n\t\t}\n\t}\n\n\tif r.MaxQueryResultRows == 0 {\n\t\tr.MaxQueryResultRows = 50\n\t}\n\n\tif r.WriteMode == WriteModeProtected && strings.ToLower(r.UseClientOAuth) != \"false\" && r.UseClientOAuth != \"\" {\n\t\t// The protected mode only allows write operations to the session's temporary datasets.\n\t\t// when using client OAuth, a new session is created every\n\t\t// time a BigQuery tool is invoked. Therefore, no session data can\n\t\t// be preserved as needed by the protected mode.\n\t\treturn nil, fmt.Errorf(\"writeMode 'protected' cannot be used with useClientOAuth enabled\")\n\t}\n\n\tif strings.ToLower(r.UseClientOAuth) != \"false\" && r.UseClientOAuth != \"\" && r.ImpersonateServiceAccount != \"\" {\n\t\treturn nil, fmt.Errorf(\"useClientOAuth cannot be used with impersonateServiceAccount\")\n\t}\n\n\tendpoint := NormalizeEndpoint(r.APIEndpoint)\n\n\tvar client *bigqueryapi.Client\n\tvar restService *bigqueryrestapi.Service\n\tvar tokenSource oauth2.TokenSource\n\tvar clientCreator BigqueryClientCreator\n\tvar err error\n\n\ts := &Source{\n\t\tConfig:              r,\n\t\tClient:              client,\n\t\tRestService:         restService,\n\t\tTokenSource:         tokenSource,\n\t\tClientCreator:       clientCreator,\n\t\tAuthTokenHeaderName: \"Authorization\",\n\t}","sourceCodeStart":156,"sourceCodeEnd":192,"githubUrl":"https://github.com/googleapis/mcp-toolbox/blob/8cc6e09de2ad7b8bffc77751799585a1401a48eb/internal/sources/bigquery/bigquery.go#L156-L192","documentation":"Initialize rejects using useClientOAuth together with impersonateServiceAccount. Client OAuth means the end user's credentials are used per invocation, while impersonation means the service account's identity is used server-side; the two auth strategies are mutually exclusive and cannot be combined.","triggerScenarios":"BigQuery source config where useClientOAuth is enabled (not \"false\" and not empty) and impersonateServiceAccount is set to a non-empty service account email.","commonSituations":"Adding impersonation for least-privilege access on a source that already enables client OAuth; template configs that include both fields unconditionally.","solutions":["Remove the impersonateServiceAccount field if client OAuth is the intended auth path.","Set useClientOAuth: \"false\" if impersonation is the intended auth path.","Split into two separate sources/configs if both auth modes are needed for different users."],"exampleFix":"// before\nuseClientOAuth: \"true\"\nimpersonateServiceAccount: sa@project.iam.gserviceaccount.com\n// after\nuseClientOAuth: \"true\"","handlingStrategy":"validation","validationCode":"func validateAuthMode(useClientOAuth, impersonate string) error {\n\tclientOAuth := useClientOAuth != \"\" && strings.ToLower(useClientOAuth) != \"false\"\n\tif clientOAuth && impersonate != \"\" {\n\t\treturn fmt.Errorf(\"useClientOAuth and impersonateServiceAccount are mutually exclusive\")\n\t}\n\treturn nil\n}","typeGuard":null,"tryCatchPattern":"src, err := sourceRegistry.Initialize(ctx, cfg)\nif err != nil {\n\tif strings.Contains(err.Error(), \"impersonateServiceAccount\") {\n\t\treturn fmt.Errorf(\"remove one auth strategy from config: %w\", err)\n\t}\n\treturn err\n}","preventionTips":["Pick one auth strategy per source config: user OAuth or service-account impersonation.","Avoid templating both fields into every generated config.","Grep configs for both fields as a pre-deploy check."],"tags":["config","oauth","impersonation","auth","bigquery"],"backgroundTag":"incompatible-config-combination","analyzedSha":"8cc6e09de2ad7b8bffc77751799585a1401a48eb","analyzedAt":"2026-09-05T01:10:36.887Z","contentChangedAt":"2026-09-05T01:10:36.887Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}