{"record":{"id":"9552934c7e65463d","repo":"pathwaycom/pathway","slug":"schemaregistrysettings-password-was-provided-wi","errorCode":null,"errorMessage":"SchemaRegistrySettings: 'password' was provided without 'username'. Both are needed for username/password authentication.","messagePattern":"SchemaRegistrySettings: 'password' was provided without 'username'\\. Both are needed for username/password authentication\\.","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"python/pathway/internals/_io_helpers.py","lineNumber":298,"sourceCode":"            raise ValueError(\n                \"SchemaRegistrySettings requires at least one entry in 'urls'; \"\n                \"got an empty list.\"\n            )\n        for i, url in enumerate(self.urls):\n            if not isinstance(url, str) or not url:\n                raise ValueError(\n                    f\"SchemaRegistrySettings.urls[{i}] must be a non-empty \"\n                    f\"string; got {url!r}.\"\n                )\n        for field_name in (\"token_authorization\", \"username\", \"password\", \"proxy\"):\n            value = getattr(self, field_name)\n            if value is not None and not isinstance(value, str):\n                raise TypeError(\n                    f\"SchemaRegistrySettings.{field_name} must be a str, \"\n                    f\"got {type(value).__name__}.\"\n                )\n        if self.password is not None and self.username is None:\n            raise ValueError(\n                \"SchemaRegistrySettings: 'password' was provided without \"\n                \"'username'. Both are needed for username/password \"\n                \"authentication.\"\n            )\n        if self.token_authorization is not None and (\n            self.username is not None or self.password is not None\n        ):\n            raise ValueError(\n                \"SchemaRegistrySettings: 'token_authorization' is mutually \"\n                \"exclusive with 'username'/'password'. Pick one \"\n                \"authentication method.\"\n            )\n        if self.headers is not None:\n            for i, header in enumerate(self.headers):\n                if not isinstance(header, SchemaRegistryHeader):\n                    raise TypeError(\n                        f\"SchemaRegistrySettings.headers[{i}] must be a \"\n                        f\"SchemaRegistryHeader instance, got \"","sourceCodeStart":280,"sourceCodeEnd":316,"githubUrl":"https://github.com/pathwaycom/pathway/blob/fa2f74a4649b7c5908690cf60137263d8d80de5f/python/pathway/internals/_io_helpers.py#L280-L316","documentation":"SchemaRegistrySettings enforces that basic authentication credentials come as a pair: if 'password' is provided, 'username' must also be provided. Supplying only a password is almost always a configuration mistake, since the registry client has no way to build an Authorization header from a password alone. The ValueError is raised eagerly in __post_init__.","triggerScenarios":"SchemaRegistrySettings(urls=[...], password='secret') with no username; passing username=None explicitly while setting a password; building settings from a config dict where the username key was misspelled (e.g. 'user') and therefore defaulted to None.","commonSituations":"Secrets loaded from a vault/env where the username variable name differs from what the code reads (REGISTRY_USER vs SCHEMA_REGISTRY_USERNAME); refactoring settings constructors and dropping the username line; machine accounts that only provision a token being wired into username/password fields.","solutions":["Provide both username and password together.","Check for a misspelled or misread username variable in your config loading code.","If your registry uses token auth, pass token_authorization='...' instead of a password.","If no auth is needed, remove the password argument entirely."],"exampleFix":"# before\nsettings = pw.io.kafka.SchemaRegistrySettings(\n    urls=[\"http://registry:8081\"],\n    password=os.environ[\"REGISTRY_TOKEN\"],\n)\n\n# after (token auth was the intent)\nsettings = pw.io.kafka.SchemaRegistrySettings(\n    urls=[\"http://registry:8081\"],\n    token_authorization=os.environ[\"REGISTRY_TOKEN\"],\n)","handlingStrategy":"validation","validationCode":"username = os.environ.get(\"REGISTRY_USERNAME\")\npassword = os.environ.get(\"REGISTRY_PASSWORD\")\nassert (username is None) == (password is None), \"provide both username and password, or neither\"\nsettings = pw.io.kafka.SchemaRegistrySettings(urls=urls, username=username, password=password)","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Load registry credentials as a pair from a single config block so they cannot diverge.","Use token_authorization for token-based setups instead of stuffing tokens into password.","Fail fast at startup on partially provisioned credentials rather than at connector build time."],"tags":["kafka","schema-registry","authentication","configuration"],"backgroundTag":null,"analyzedSha":"fa2f74a4649b7c5908690cf60137263d8d80de5f","analyzedAt":"2026-08-15T01:48:17.006Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}