{"record":{"id":"cb7df13566e55bcb","repo":"testcontainers/testcontainers-java","slug":"service-account-token-cannot-be-empty","errorCode":null,"errorMessage":"Service account token cannot be empty","messagePattern":"Service account token cannot be empty","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"modules/elasticsearch/src/main/java/org/testcontainers/elasticsearch/KibanaContainer.java","lineNumber":236,"sourceCode":"    }\n\n    /**\n     * Configures a service account token for Elasticsearch authentication.\n     *\n     * @param token the service account token\n     * @return this container instance\n     * @throws IllegalStateException if username/password credentials are already configured\n     * @throws IllegalArgumentException if token is blank\n     */\n    public KibanaContainer withElasticsearchServiceAccountToken(String token) {\n        if (elasticsearchUsername != null) {\n            throw new IllegalStateException(\n                \"Conflicting Elasticsearch credentials: provide either a service account token \" +\n                \"or a username/password pair, not both.\"\n            );\n        }\n        if (StringUtils.isBlank(token)) {\n            throw new IllegalArgumentException(\"Service account token cannot be empty\");\n        }\n\n        if (!token.equals(token.trim())) {\n            throw new IllegalArgumentException(\"Service token cannot have leading or trailing whitespace\");\n        }\n        this.elasticsearchServiceAccountToken = token;\n        return this;\n    }\n\n    /**\n     * Configures the Elasticsearch CA certificate for HTTPS connections.\n     *\n     * @param caCertificate the CA certificate in PEM format\n     * @return this container instance\n     * @throws IllegalArgumentException if certificate is empty\n     */\n    public KibanaContainer withElasticsearchCaCertificate(byte[] caCertificate) {\n        if (caCertificate == null || caCertificate.length == 0) {","sourceCodeStart":218,"sourceCodeEnd":254,"githubUrl":"https://github.com/testcontainers/testcontainers-java/blob/8e549514e3f01c57d70546fbb8599d138f3903e5/modules/elasticsearch/src/main/java/org/testcontainers/elasticsearch/KibanaContainer.java#L218-L254","documentation":"Thrown by KibanaContainer.withElasticsearchServiceAccountToken when the service account token argument is null or blank. Testcontainers validates eagerly at configuration time so the failure surfaces on the host, not after Kibana starts and fails to authenticate. The token is used as base64 'id:api_key' service-account credentials for Elasticsearch.","triggerScenarios":"Calling withElasticsearchServiceAccountToken(null), withElasticsearchServiceAccountToken(\"\") or a whitespace-only string such as \" \".","commonSituations":"Reading the token from an environment variable or config file that is unset/empty before passing it in; a YAML property binding that yields an empty string.","solutions":["Pass a real base64-encoded service account token (created via `bin/elasticsearch-service-tokens create ...`) to withElasticsearchServiceAccountToken.","Fix the source of the token (env var, secret, file) so it is non-blank before configuring the container.","If you intended username/password auth instead, use withElasticsearchUsername/withElasticsearchPassword and drop the token call."],"exampleFix":"// before\ncontainer.withElasticsearchServiceAccountToken(System.getenv(\"ES_SA_TOKEN\"));\n// after\nString token = System.getenv(\"ES_SA_TOKEN\");\nif (token != null && !token.isBlank()) {\n    container.withElasticsearchServiceAccountToken(token);\n} else {\n    throw new IllegalArgumentException(\"ES_SA_TOKEN env var must be set\");\n}","handlingStrategy":"validation","validationCode":"if (token == null || token.isBlank()) throw new IllegalArgumentException(\"ES service account token must be a non-blank string\");\ncontainer.withElasticsearchServiceAccountToken(token);","typeGuard":"boolean isValidToken(String t) { return t != null && !t.isBlank(); }","tryCatchPattern":"try { container.withElasticsearchServiceAccountToken(token); } catch (IllegalArgumentException e) { log.error(\"Invalid ES service account token\", e); throw new ConfigException(\"ES_SA_TOKEN is unset or blank\"); }","preventionTips":["Load tokens from secrets and assert non-blank at config load time","Prefer username/password auth via withElasticsearchUsername/Password if you don't have a service account token","Fail fast in test setup (before container start) when required env vars are missing"],"tags":["validation","elasticsearch","testcontainers","empty-argument"],"backgroundTag":"empty-required-field","analyzedSha":"8e549514e3f01c57d70546fbb8599d138f3903e5","analyzedAt":"2026-09-12T14:56:41.227Z","contentChangedAt":"2026-09-12T14:56:41.227Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}