{"record":{"id":"a2e4af46b5c5f3cc","repo":"apache/beam","slug":"privatekeypassphrase-requires-privatekey","errorCode":null,"errorMessage":"privateKeyPassphrase requires privateKey.","messagePattern":"privateKeyPassphrase requires privateKey\\.","errorType":"validation","errorClass":"java.lang.IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"sdks/java/io/snowflake/src/main/java/org/apache/beam/sdk/io/snowflake/SnowflakeSchemaTransformUtils.java","lineNumber":116,"sourceCode":"    }\n\n    if (isNotEmpty(privateKey)) {\n      authenticationMethods++;\n    }\n\n    if (authenticationMethods != 1) {\n      throw new IllegalArgumentException(\n          \"Exactly one authentication method must be configured: \"\n              + \"password, oauthToken, or privateKey.\");\n    }\n\n    if ((isNotEmpty(password) || isNotEmpty(privateKey)) && !isNotEmpty(username)) {\n      throw new IllegalArgumentException(\n          \"username is required for password and private key authentication.\");\n    }\n\n    if (isNotEmpty(privateKeyPassphrase) && !isNotEmpty(privateKey)) {\n      throw new IllegalArgumentException(\"privateKeyPassphrase requires privateKey.\");\n    }\n  }\n\n  @EnsuresNonNullIf(expression = \"#1\", result = true)\n  public static boolean isNotEmpty(@Nullable String value) {\n    return value != null && !value.isEmpty();\n  }\n\n  public static StreamingLogLevel parseStreamingLogLevel(String value) {\n    try {\n      return StreamingLogLevel.valueOf(value);\n    } catch (IllegalArgumentException e) {\n      throw new IllegalArgumentException(\n          \"Unsupported debugMode '\" + value + \"'. Supported values are ERROR and INFO.\", e);\n    }\n  }\n\n  public static CreateDisposition parseCreateDisposition(String value) {","sourceCodeStart":98,"sourceCodeEnd":134,"githubUrl":"https://github.com/apache/beam/blob/12126d8942aaf848030c478b4c6a28c6af861c66/sdks/java/io/snowflake/src/main/java/org/apache/beam/sdk/io/snowflake/SnowflakeSchemaTransformUtils.java#L98-L134","documentation":"SnowflakeSchemaTransformUtils.validateAuthentication enforces that a private key passphrase only makes sense alongside an actual private key. If privateKeyPassphrase is set (non-null and non-empty) but privateKey is missing, the config is considered invalid and an IllegalArgumentException is thrown during validation of the Snowflake transform configuration.","triggerScenarios":"Calling a Snowflake IO schema transform (read/write) configuration builder with privateKeyPassphrase set but privateKey null or empty, then invoking validateAuthentication.","commonSituations":"Copying config from a key-pair auth example but forgetting to supply the private key; loading the passphrase from a secret manager while the key path/env var failed to resolve; switching auth methods from key-pair to password and leaving the passphrase behind.","solutions":["Set privateKey (PEM content or key path depending on config) alongside privateKeyPassphrase.","Remove privateKeyPassphrase if you are not using private key authentication.","Validate config early with validateAuthentication before submitting the pipeline."],"exampleFix":"// before\n.withUsername(\"user\")\n.withPrivateKeyPassphrase(\"s3cret\")\n// after\n.withUsername(\"user\")\n.withPrivateKey(\"-----BEGIN PRIVATE KEY-----\\n...\")\n.withPrivateKeyPassphrase(\"s3cret\")","handlingStrategy":"validation","validationCode":"if (isNotEmpty(passphrase) && !isNotEmpty(privateKey)) {\n  throw new IllegalArgumentException(\"privateKeyPassphrase requires privateKey.\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always configure privateKey and privateKeyPassphrase together for key-pair auth.","Run validateAuthentication early in pipeline setup, before submit.","Source both values from the same secret/config block to avoid partial loads."],"tags":["java","snowflake","authentication","configuration"],"backgroundTag":"missing-required-config-field","analyzedSha":"12126d8942aaf848030c478b4c6a28c6af861c66","analyzedAt":"2026-09-13T01:50:10.254Z","contentChangedAt":"2026-09-13T01:50:10.254Z","schemaVersion":2},"datasetVersion":"2026-09-20T03:17:13.778Z"}