{"record":{"id":"a081c9d1ed78d57b","repo":"googleapis/mcp-toolbox","slug":"error-getting-email-from-adc-v-a081c9","errorCode":null,"errorMessage":"error getting email from ADC: %v","messagePattern":"error getting email from ADC: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/sources/cloudsqlpg/cloud_sql_pg.go","lineNumber":168,"sourceCode":"\t\tuserAgent = \"genai-toolbox\"\n\t}\n\tuseIAM := true\n\n\tvar dsn string\n\t// If username and password both provided, use password authentication\n\tif user != \"\" && pass != \"\" {\n\t\tdsn = fmt.Sprintf(\"user=%s password=%s dbname=%s sslmode=disable application_name=%s\", user, pass, dbname, userAgent)\n\t\tuseIAM = false\n\t} else if user == \"\" {\n\t\t// If username is empty, fetch email from ADC\n\t\t// otherwise, use username as IAM email\n\t\tif pass != \"\" {\n\t\t\t// If password is provided without an username, raise an error\n\t\t\treturn \"\", useIAM, fmt.Errorf(\"password is provided without a username. Please provide both a username and password, or leave both fields empty\")\n\t\t}\n\t\temail, err := sources.GetIAMPrincipalEmailFromADC(ctx, \"postgres\")\n\t\tif err != nil {\n\t\t\treturn \"\", useIAM, fmt.Errorf(\"error getting email from ADC: %v\", err)\n\t\t}\n\t\tuser = email\n\t\tdsn = fmt.Sprintf(\"user=%s dbname=%s sslmode=disable application_name=%s\", user, dbname, userAgent)\n\t} else {\n\t\t// Construct IAM connection string with username\n\t\tdsn = fmt.Sprintf(\"user=%s dbname=%s sslmode=disable application_name=%s\", user, dbname, userAgent)\n\t}\n\n\tif readOnly {\n\t\t// IMPORTANT: Must use underscore ('cloudsql_session_read_only'), NOT a dot.\n\t\t// PostgreSQL treats dotted GUCs (e.g. 'cloudsql.session_read_only') as custom placeholders\n\t\t// and silently ignores them at connection time, leaving the session in read-write mode.\n\t\tdsn += \" options='-c cloudsql_session_read_only=locked'\"\n\t}\n\n\treturn dsn, useIAM, nil\n}\n","sourceCodeStart":150,"sourceCodeEnd":186,"githubUrl":"https://github.com/googleapis/mcp-toolbox/blob/8cc6e09de2ad7b8bffc77751799585a1401a48eb/internal/sources/cloudsqlpg/cloud_sql_pg.go#L150-L186","documentation":"When no username is configured, the source derives the IAM principal email from Application Default Credentials via GetIAMPrincipalEmailFromADC (dialect 'postgres') and uses it as the Postgres user. If ADC are missing, invalid, or lack token scopes, this error is wrapped and the pool initialization aborts.","triggerScenarios":"Initializing a cloud-sql-postgres source with empty 'user' and 'password' fields while Application Default Credentials are unavailable (no GOOGLE_APPLICATION_CREDENTIALS, no gcloud auth, or metadata server inaccessible).","commonSituations":"Running the toolbox locally without 'gcloud auth application-default login'; CI/container without a mounted service-account key; workload identity not configured; service account lacking the Cloud SQL Client role; ADC JSON corrupted or expired.","solutions":["Run 'gcloud auth application-default login' locally, or set GOOGLE_APPLICATION_CREDENTIALS to a valid service-account key.","Grant the identity the roles/cloudsql.client IAM role so it can authenticate to the instance.","Alternatively, set explicit 'user' and 'password' fields to bypass ADC email lookup.","In GKE/Cloud Run, ensure workload identity / service account attachment is configured correctly."],"exampleFix":"// before: gcloud auth application-default login not run\n// after:\n//   gcloud auth application-default login\n// or set GOOGLE_APPLICATION_CREDENTIALS=/path/to/sa-key.json","handlingStrategy":"validation","validationCode":"tok, err := google.FindDefaultCredentials(ctx)\nif err != nil {\n    return fmt.Errorf(\"ADC unavailable: run 'gcloud auth application-default login' or set GOOGLE_APPLICATION_CREDENTIALS\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Run 'gcloud auth application-default login' before local runs","Mount a service-account key in CI/containers and set GOOGLE_APPLICATION_CREDENTIALS","Grant roles/cloudsql.client to the identity","Check ADC health with 'gcloud auth application-default print-access-token'"],"tags":["gcp","iam-auth","adc","cloudsql","credentials"],"backgroundTag":"missing-application-default-credentials","analyzedSha":"8cc6e09de2ad7b8bffc77751799585a1401a48eb","analyzedAt":"2026-09-05T01:10:36.887Z","contentChangedAt":"2026-09-05T01:10:36.887Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}