{"record":{"id":"8713214ba435629a","repo":"testcontainers/testcontainers-java","slug":"conflicting-elasticsearch-credentials-provide-either-a","errorCode":null,"errorMessage":"Conflicting Elasticsearch credentials: provide either a service account token or a username/password pair, not both.","messagePattern":"Conflicting Elasticsearch credentials: provide either a service account token or a username/password pair, not both\\.","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"modules/elasticsearch/src/main/java/org/testcontainers/elasticsearch/KibanaContainer.java","lineNumber":200,"sourceCode":"     * @param password the password for the kibana_system user\n     * @return this container instance\n     */\n    public KibanaContainer withKibanaSystemPassword(String password) {\n        return withKibanaUsernameAndPassword(KIBANA_SYSTEM_USER, password);\n    }\n\n    /**\n     * Configures credentials Kibana will use for authentication.\n     *\n     * @param username the Elasticsearch username (cannot be 'elastic')\n     * @param password the password\n     * @return this container instance\n     * @throws IllegalStateException if a service account token is already configured\n     * @throws IllegalArgumentException if credentials are invalid\n     */\n    public KibanaContainer withKibanaUsernameAndPassword(String username, String password) {\n        if (elasticsearchServiceAccountToken != null) {\n            throw new IllegalStateException(\n                \"Conflicting Elasticsearch credentials: provide either a service account token \" +\n                \"or a username/password pair, not both.\"\n            );\n        }\n        if (StringUtils.isAnyBlank(username, password)) {\n            throw new IllegalArgumentException(\"Kibana credentials cannot be blank\");\n        }\n        if (!username.equals(username.trim()) || !password.equals(password.trim())) {\n            throw new IllegalArgumentException(\"Kibana credentials cannot have leading or trailing whitespace\");\n        }\n        if (\"elastic\".equals(username)) {\n            throw new IllegalArgumentException(\"Username 'elastic' is reserved for internal use by Elasticsearch\");\n        }\n\n        this.elasticsearchUsername = username;\n        this.elasticsearchPassword = password;\n        return this;\n    }","sourceCodeStart":182,"sourceCodeEnd":218,"githubUrl":"https://github.com/testcontainers/testcontainers-java/blob/8e549514e3f01c57d70546fbb8599d138f3903e5/modules/elasticsearch/src/main/java/org/testcontainers/elasticsearch/KibanaContainer.java#L182-L218","documentation":"KibanaContainer allows exactly one Elasticsearch authentication method: either a service account token or a username/password pair. withKibanaUsernameAndPassword throws IllegalStateException if a service account token was already set via withElasticsearchServiceAccountToken, preventing mutually exclusive credentials from being written into Kibana's environment.","triggerScenarios":"Calling withKibanaUsernameAndPassword(...) after withElasticsearchServiceAccountToken(...) has been called on the same container.","commonSituations":"Merging configuration helpers where one sets token auth and another sets basic auth; incremental migration from basic auth to service account tokens without removing the old call.","solutions":["Remove the withElasticsearchServiceAccountToken(...) call if you intend username/password auth.","Or remove withKibanaUsernameAndPassword(...) and keep token-based auth.","Ensure only one credential mechanism is configured per KibanaContainer."],"exampleFix":"// before\n.withElasticsearchServiceAccountToken(token)\n.withKibanaUsernameAndPassword(\"kibana\", \"pass\"); // throws\n// after\n.withElasticsearchServiceAccountToken(token);","handlingStrategy":"validation","validationCode":"if (serviceToken != null && (username != null || password != null)) throw new IllegalStateException(\"Configure either service account token or username/password, not both\");","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Decide the auth mechanism per test suite before configuring containers.","Remove token configuration when switching to basic auth and vice versa.","Use one helper method for Kibana credential setup."],"tags":["kibana","elasticsearch","credentials","conflicting-options"],"backgroundTag":"conflicting-config-options","analyzedSha":"8e549514e3f01c57d70546fbb8599d138f3903e5","analyzedAt":"2026-09-12T14:56:41.227Z","contentChangedAt":"2026-09-12T14:56:41.227Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}