{"record":{"id":"bd158a790dbaa93d","repo":"pentaho/pentaho-kettle","slug":"passwords-are-not-supported-directly-try-configuring-your","errorCode":null,"errorMessage":"Passwords are not supported directly, try configuring your connection for trusted access using pg_hba.conf","messagePattern":"Passwords are not supported directly, try configuring your connection for trusted access using pg_hba\\.conf","errorType":"exception","errorClass":"KettleException","httpStatus":null,"severity":"error","filePath":"plugins/gp-bulk-loader/core/src/main/java/org/pentaho/di/trans/steps/gpbulkloader/GPBulkLoader.java","lineNumber":361,"sourceCode":"          KettleVFS.getInstance( getTransMeta().getBowl() )\n            .getFileObject( environmentSubstitute( meta.getLogFile() ), getTransMeta() );\n\n        sb.append( \" -o \" );\n        sb.append( enclosure ).append( KettleVFS.getFilename( fileObject ) ).append( enclosure );\n      } catch ( Exception ex ) {\n        throw new KettleException( \"Error retrieving logfile string\", ex );\n      }\n    }\n\n    DatabaseMeta dm = meta.getDatabaseMeta();\n    if ( dm != null ) {\n      String user = Const.NVL( dm.getUsername(), \"\" );\n\n      // Passwords will not work for now because we can't get them to the command line without assuming UNIX and using\n      // an environment variable\n      String pass = Const.NVL( dm.getPassword(), \"\" );\n      if ( password && !pass.equalsIgnoreCase( \"\" ) ) {\n        throw new KettleException(\n          \"Passwords are not supported directly, try configuring \"\n            + \"your connection for trusted access using pg_hba.conf\" );\n      }\n      // if ( ! password )\n      // {\n      // pass = \"******\";\n      // }\n      // String dns = Const.NVL(dm.getDatabaseName(), \"\");\n      // sb.append(\" -U \").append(environmentSubstitute(user)).append(\"/\").append(environmentSubstitute(pass));\n\n      sb.append( \" -U \" ).append( environmentSubstitute( user ) );\n\n      // Hostname and portname\n      String hostname = Const.NVL( dm.getHostname(), \"\" );\n      String portnum = Const.NVL( dm.getDatabasePortNumberString(), \"\" );\n      sb.append( \" -h \" );\n      sb.append( hostname );\n      sb.append( \" -p \" );","sourceCodeStart":343,"sourceCodeEnd":379,"githubUrl":"https://github.com/pentaho/pentaho-kettle/blob/f3058517a153da500bf4551f46d79b91bf8ec552/plugins/gp-bulk-loader/core/src/main/java/org/pentaho/di/trans/steps/gpbulkloader/GPBulkLoader.java#L343-L379","documentation":"createCommandLine() cannot pass a database password on the psql command line securely (it would be visible in process listings and there is no portable way to supply it), so if the 'Use password' flag is checked and the connection metadata has a non-empty password, the step deliberately throws this KettleException. The intended design is trusted (passwordless) access via pg_hba.conf or a .pgpass file.","triggerScenarios":"execute() -> createCommandLine(meta, password=true) where dm.getPassword() is non-empty: the step's 'Use password' option is enabled AND the database connection definition contains a password. Any password present with that flag is rejected before the command runs.","commonSituations":"Developer copies a working JDBC connection with a stored password into the bulk loader step; someone enables the password option thinking it will be passed to psql; running in an environment where pg_hba.conf requires md5 auth so trusted access was never configured.","solutions":["Uncheck/disable the password option for the bulk loader step so createCommandLine is called with password=false.","Configure trusted authentication in PostgreSQL/Greenplum pg_hba.conf for the Kettle host (e.g. host/trust or ident), then reload the config.","Alternatively set up a ~/.pgpass file (chmod 600) on the machine running Kettle so psql can authenticate without a command-line password.","Use a passwordless connection definition (empty password) for the step if the DB allows trust auth from that host."],"exampleFix":"// before: pg_hba.conf requiring password\nhost  all  all  10.0.0.0/24  md5\n\n// after: trusted access for the ETL host\nhost  all  all  10.0.0.0/24  trust\n-- then reload: SELECT pg_reload_conf();","handlingStrategy":"validation","validationCode":"DatabaseMeta dm = meta.getDatabaseMeta();\nboolean usePassword = true; // the step's password option\nif (usePassword && dm != null\n    && dm.getPassword() != null && !dm.getPassword().isEmpty()) {\n  throw new IllegalStateException(\n    \"Configure pg_hba.conf trusted access or a .pgpass file instead of passing a password\");\n}","typeGuard":null,"tryCatchPattern":"try {\n  execute(meta, wait);\n} catch (KettleException e) {\n  if (e.getMessage().contains(\"Passwords are not supported directly\")) {\n    throw new IllegalStateException(\n      \"Enable trusted auth in pg_hba.conf or set up ~/.pgpass, then disable the password option\", e);\n  } else throw e;\n}","preventionTips":["Never enable the password option for this step; rely on pg_hba.conf trust/ident or .pgpass","Use a connection definition with an empty password for bulk loading","Document the required pg_hba.conf entry for each ETL host in deployment runbooks"],"tags":["security","password","psql","authentication","kettle"],"backgroundTag":"authentication-required","analyzedSha":"f3058517a153da500bf4551f46d79b91bf8ec552","analyzedAt":"2026-09-13T14:04:16.340Z","contentChangedAt":"2026-09-13T14:04:16.340Z","schemaVersion":2},"datasetVersion":"2026-09-20T23:17:15.980Z"}