{"record":{"id":"bf9ab5744f630229","repo":"pentaho/pentaho-kettle","slug":"mail-log-authenticationpasswordfieldempty","errorCode":null,"errorMessage":"Mail.Log.AuthenticationPasswordFieldEmpty","messagePattern":"Mail\\.Log\\.AuthenticationPasswordFieldEmpty","errorType":"validation","errorClass":"KettleException","httpStatus":null,"severity":"error","filePath":"plugins/mail/impl/src/main/java/org/pentaho/di/trans/steps/mail/Mail.java","lineNumber":497,"sourceCode":"    }\n\n    // Check Attached zipfilename when dynamic\n    if ( meta.isZipFilenameDynamic() && Utils.isEmpty( meta.getDynamicZipFilenameField() ) ) {\n      throw new KettleException( BaseMessages.getString( PKG, \"Mail.Log.DynamicZipFilenameFieldEmpty\" ) );\n    }\n\n    validateZipFiles( meta );\n\n    // check authentication\n    if ( meta.isUsingAuthentication().equals( AUTENTICATION_BASIC ) ) {\n      // check authentication user\n      if ( Utils.isEmpty( meta.getAuthenticationUser() ) ) {\n        throw new KettleException( BaseMessages.getString( PKG, \"Mail.Log.AuthenticationUserFieldEmpty\" ) );\n      }\n\n      // check authentication pass\n      if ( Utils.isEmpty( meta.getAuthenticationPassword() ) ) {\n        throw new KettleException( BaseMessages.getString( PKG, \"Mail.Log.AuthenticationPasswordFieldEmpty\" ) );\n      }\n    }\n  }\n\n  @VisibleForTesting\n  void validateZipFiles( MailMeta meta ) throws KettleException {\n    if ( meta.isZipFiles() && ( Utils.isEmpty( meta.getZipFilename() ) && !meta.isZipFilenameDynamic() ) ) {\n      throw new KettleException( BaseMessages.getString( PKG, \"Mail.Log.ZipFilenameEmpty\" ) );\n    }\n  }\n\n  @VisibleForTesting\n  void processAttachedFiles() throws KettleException {\n    if ( meta.isDynamicFilename() ) {\n      // cache the position of the attached source filename field\n      cacheSourceFileNameField();\n      // cache the position of the attached wildcard field\n      cacheWildCardField();","sourceCodeStart":479,"sourceCodeEnd":515,"githubUrl":"https://github.com/pentaho/pentaho-kettle/blob/f3058517a153da500bf4551f46d79b91bf8ec552/plugins/mail/impl/src/main/java/org/pentaho/di/trans/steps/mail/Mail.java#L479-L515","documentation":"Thrown by Mail.validateMetaFields when basic SMTP authentication is enabled but meta.getAuthenticationPassword() is empty. The username check (3195) has already passed, so the account name is set but its password is missing; the step aborts before attempting to send mail. This is metadata validation, not an SMTP authentication failure.","triggerScenarios":"Filling the Authentication User but leaving Authentication Password blank with basic auth enabled; password supplied via a ${variable} that is undefined so it resolves empty; code-built MailMeta setting the user but not setAuthenticationPassword(...).","commonSituations":"Security policies that strip passwords from exported transformations; passwords stored in kettle.properties not deployed to the executing node; users rotating credentials and clearing the password field.","solutions":["Enter the SMTP password (or the ${VARIABLE} containing it) in the Mail step's Authentication Password field.","Call meta.setAuthenticationPassword(\"...\" ) in code, ideally sourced from an environment variable rather than hardcoded.","Confirm any referenced KETTLE variable is defined on the machine running the transformation.","If no password is needed, switch authentication off rather than leaving basic auth enabled."],"exampleFix":"// before\nmeta.setAuthenticationUser(\"smtpUser\");\n// after\nmeta.setAuthenticationUser(\"smtpUser\");\nmeta.setAuthenticationPassword(System.getenv(\"SMTP_PASSWORD\"));","handlingStrategy":"validation","validationCode":"if ( MailMeta.AUTENTICATION_BASIC.equals( meta.isUsingAuthentication() )\n     && ( meta.getAuthenticationPassword() == null || meta.getAuthenticationPassword().trim().isEmpty() ) ) {\n  throw new IllegalArgumentException(\"Mail step: authentication password required for basic auth\");\n}","typeGuard":null,"tryCatchPattern":"try { transformation.execute(); } catch ( KettleException e ) { if ( e.getMessage().contains(\"AuthenticationPasswordFieldEmpty\") ) { /* set password from secure env variable */ } else { throw e; } }","preventionTips":["Store SMTP passwords in kettle.properties or a vault, referenced by variable","After credential rotation, re-deploy updated variables to all nodes","Never export transformations with passwords stripped and assume they still work"],"tags":["kettle","mail-step","smtp","authentication","validation"],"backgroundTag":"missing-credentials","analyzedSha":"f3058517a153da500bf4551f46d79b91bf8ec552","analyzedAt":"2026-09-13T14:04:16.340Z","contentChangedAt":"2026-09-13T14:04:16.340Z","schemaVersion":2},"datasetVersion":"2026-09-20T23:17:15.980Z"}