{"record":{"id":"a1c57a837d480dab","repo":"risingwavelabs/risingwave","slug":"ambiguous-auth-multiple-auth-options-provided-re","errorCode":null,"errorMessage":"ambiguous auth: multiple auth options provided; remove one or set `auth.method`","messagePattern":"ambiguous auth: multiple auth options provided; remove one or set `auth\\.method`","errorType":"validation","errorClass":"SinkError::Config","httpStatus":null,"severity":"error","filePath":"src/connector/src/sink/snowflake_redshift/snowflake.rs","lineNumber":338,"sourceCode":"                        \"auth.method=key_pair_object must not set `password`\"\n                    )));\n                }\n                AUTH_METHOD_KEY_PAIR_OBJECT.to_owned()\n            }\n            Some(other) => {\n                return Err(SinkError::Config(anyhow!(\n                    \"invalid auth.method: {} (allowed: password | key_pair_file | key_pair_object)\",\n                    other\n                )));\n            }\n            None => {\n                // Infer auth method from supplied fields\n                match (has_password, has_file, has_pem) {\n                    (true, false, false) => AUTH_METHOD_PASSWORD.to_owned(),\n                    (false, true, false) => AUTH_METHOD_KEY_PAIR_FILE.to_owned(),\n                    (false, false, true) => AUTH_METHOD_KEY_PAIR_OBJECT.to_owned(),\n                    (true, true, _) | (true, _, true) | (false, true, true) => {\n                        return Err(SinkError::Config(anyhow!(\n                            \"ambiguous auth: multiple auth options provided; remove one or set `auth.method`\"\n                        )));\n                    }\n                    _ => {\n                        return Err(SinkError::Config(anyhow!(\n                            \"no authentication configured: set either `password`, or `private_key_file`, or `private_key_pem` (or provide `auth.method`)\"\n                        )));\n                    }\n                }\n            }\n        };\n        config.auth_method = Some(normalized_auth_method);\n        Ok(config)\n    }\n\n    pub fn build_snowflake_task_ctx_jdbc_client(\n        &self,\n        is_append_only: bool,","sourceCodeStart":320,"sourceCodeEnd":356,"githubUrl":"https://github.com/risingwavelabs/risingwave/blob/6469eb736d691e8e9b8a419a57edd6429ca77417/src/connector/src/sink/snowflake_redshift/snowflake.rs#L320-L356","documentation":"When `auth.method` is not set, the Snowflake sink infers the auth method from which credential fields are present. If more than one of `password`, `private_key_file`, and `private_key_pem` is supplied, the method is ambiguous and the connector refuses to guess.","triggerScenarios":"Calling `from_btreemap` (CREATE SINK) without `auth.method` while providing two or more of: `password`, `private_key_file`, `private_key_pem`.","commonSituations":"Merging sink definitions or migrating from password auth to key-pair auth while leaving both credential options in the WITH clause.","solutions":["Remove all but one credential option (`password`, `private_key_file`, or `private_key_pem`).","Or explicitly set `auth.method` to the intended method so the connector knows which credential to use.","Audit the sink definition (and any templating/variables) for leftover credential fields."],"exampleFix":"// before\nWITH (\n  connector = 'snowflake',\n  password = 'secret',\n  private_key_file = '/path/key.p8'\n)\n// after\nWITH (\n  connector = 'snowflake',\n  auth.method = 'key_pair_file',\n  private_key_file = '/path/key.p8'\n)","handlingStrategy":"validation","validationCode":"const creds = ['password', 'private_key_file', 'private_key_pem'].filter(k => opts[k]);\nif (creds.length > 1 && !opts['auth.method']) {\n  throw new Error(`Ambiguous auth: multiple creds set (${creds})`);\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Set `auth.method` explicitly whenever more than one credential option could be present.","Audit templated sink DDL for credentials inherited from previous versions.","Standardize on one auth mechanism per environment."],"tags":["snowflake","sink","authentication","config"],"backgroundTag":"conflicting-config-options","analyzedSha":"6469eb736d691e8e9b8a419a57edd6429ca77417","analyzedAt":"2026-09-11T21:06:21.487Z","contentChangedAt":"2026-09-11T21:06:21.487Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}