{"record":{"id":"8357b58540e0d5cb","repo":"provectus/kafka-ui","slug":"you-specified-username-but-do-not-specified-passwo","errorCode":null,"errorMessage":"You specified username but do not specified password","messagePattern":"You specified username but do not specified password","errorType":"validation","errorClass":"ValidationException","httpStatus":null,"severity":"error","filePath":"kafka-ui-api/src/main/java/com/provectus/kafka/ui/serdes/builtin/sr/SchemaRegistrySerde.java","lineNumber":145,"sourceCode":"    this.keySchemaNameTemplate = keySchemaNameTemplate;\n    this.valueSchemaNameTemplate = valueSchemaNameTemplate;\n    this.schemaRegistryFormatters = MessageFormatter.createMap(schemaRegistryClient);\n    this.checkSchemaExistenceForDeserialize = checkTopicSchemaExistenceForDeserialize;\n  }\n\n  private static SchemaRegistryClient createSchemaRegistryClient(List<String> urls,\n                                                                 @Nullable String username,\n                                                                 @Nullable String password,\n                                                                 @Nullable String keyStoreLocation,\n                                                                 @Nullable String keyStorePassword,\n                                                                 @Nullable String trustStoreLocation,\n                                                                 @Nullable String trustStorePassword) {\n    Map<String, String> configs = new HashMap<>();\n    if (username != null && password != null) {\n      configs.put(BASIC_AUTH_CREDENTIALS_SOURCE, \"USER_INFO\");\n      configs.put(USER_INFO_CONFIG, username + \":\" + password);\n    } else if (username != null) {\n      throw new ValidationException(\n          \"You specified username but do not specified password\");\n    } else if (password != null) {\n      throw new ValidationException(\n          \"You specified password but do not specified username\");\n    }\n\n    // We require at least a truststore. The logic is done similar to SchemaRegistryService.securedWebClientOnTLS\n    if (trustStoreLocation != null && trustStorePassword != null) {\n      configs.put(SchemaRegistryClientConfig.CLIENT_NAMESPACE + SslConfigs.SSL_TRUSTSTORE_LOCATION_CONFIG,\n          trustStoreLocation);\n      configs.put(SchemaRegistryClientConfig.CLIENT_NAMESPACE + SslConfigs.SSL_TRUSTSTORE_PASSWORD_CONFIG,\n          trustStorePassword);\n    }\n\n    if (keyStoreLocation != null && keyStorePassword != null) {\n      configs.put(SchemaRegistryClientConfig.CLIENT_NAMESPACE + SslConfigs.SSL_KEYSTORE_LOCATION_CONFIG,\n          keyStoreLocation);\n      configs.put(SchemaRegistryClientConfig.CLIENT_NAMESPACE + SslConfigs.SSL_KEYSTORE_PASSWORD_CONFIG,","sourceCodeStart":127,"sourceCodeEnd":163,"githubUrl":"https://github.com/provectus/kafka-ui/blob/83b5a60cc08501b570a0c4d0b4cdfceb1b88d6b7/kafka-ui-api/src/main/java/com/provectus/kafka/ui/serdes/builtin/sr/SchemaRegistrySerde.java#L127-L163","documentation":"SchemaRegistrySerde builds a Confluent Schema Registry client. BASIC auth credentials must be supplied as a username+password pair; a username without a password cannot form the USER_INFO credential source, so ValidationException is thrown. The sibling check throws an analogous error for password-without-username.","triggerScenarios":"createSchemaRegistryClient (via configure/autoConfigure) invoked with username != null and password == null — e.g. schemaRegistryAuthUsername set but schemaRegistryAuthPassword missing.","commonSituations":"Partial environment variable injection in deployments (username secret mounted, password secret missing); typos in the password property key; intentionally blank password in config.","solutions":["Set the password property/secret (schemaRegistryAuthPassword) alongside the username","If the registry truly needs no auth, remove the username too — both must be present or both absent","Check the deployment/secret mounts so both credential values actually reach the process"],"exampleFix":"// before\nkafka:\n  clusters:\n    - schemaRegistryAuthUsername: admin\n# after\nkafka:\n  clusters:\n    - schemaRegistryAuthUsername: admin\n      schemaRegistryAuthPassword: ${SR_PASSWORD}","handlingStrategy":"validation","validationCode":"if ((username == null) != (password == null)) { throw new IllegalArgumentException(\"schema registry auth requires both username and password (or neither)\"); }","typeGuard":"boolean srAuthComplete(String u, String p) { return (u == null) == (p == null); }","tryCatchPattern":"try { serde.autoConfigure(props); } catch (ValidationException e) { throw new ConfigurationException(\"Schema Registry credentials incomplete: \" + e.getMessage()); }","preventionTips":["Store username and password in the same secret and mount them together","Validate env vars for SR credentials at deploy time","Never set only one of schemaRegistryAuthUsername/schemaRegistryAuthPassword"],"tags":["configuration","authentication","schema-registry"],"backgroundTag":"missing-credentials","analyzedSha":"83b5a60cc08501b570a0c4d0b4cdfceb1b88d6b7","analyzedAt":"2026-09-08T04:35:39.002Z","contentChangedAt":"2026-09-08T04:35:39.002Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}