{"record":{"id":"d94256a27f4733e9","repo":"googleapis/mcp-toolbox","slug":"missing-password-parameter-for-non-iam-user","errorCode":null,"errorMessage":"missing 'password' parameter for non-IAM user","messagePattern":"missing 'password' parameter for non-IAM user","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/sources/cloudsqladmin/cloud_sql_admin.go","lineNumber":215,"sourceCode":"\treturn resp, nil\n}\n\nfunc (s *Source) CreateUsers(ctx context.Context, project, instance, name, password string, iamUser bool, accessToken string) (any, error) {\n\tservice, err := s.GetService(ctx, accessToken)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tuser := sqladmin.User{\n\t\tName: name,\n\t}\n\n\tif iamUser {\n\t\tuser.Type = \"CLOUD_IAM_USER\"\n\t} else {\n\t\tuser.Type = \"BUILT_IN\"\n\t\tif password == \"\" {\n\t\t\treturn nil, fmt.Errorf(\"missing 'password' parameter for non-IAM user\")\n\t\t}\n\t\tuser.Password = password\n\t}\n\n\tresp, err := service.Users.Insert(project, instance, &user).Do()\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error creating user: %w\", err)\n\t}\n\n\treturn resp, nil\n}\n\nfunc (s *Source) GetInstance(ctx context.Context, projectId, instanceId, accessToken string) (any, error) {\n\tservice, err := s.GetService(ctx, accessToken)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n","sourceCodeStart":197,"sourceCodeEnd":233,"githubUrl":"https://github.com/googleapis/mcp-toolbox/blob/8cc6e09de2ad7b8bffc77751799585a1401a48eb/internal/sources/cloudsqladmin/cloud_sql_admin.go#L197-L233","documentation":"Validation error in CreateUsers: when the new user is not an IAM user (user.Type = BUILT_IN), Cloud SQL requires a password, but an empty password string was supplied. The library fails fast before calling the API.","triggerScenarios":"Invoking the create_user tool (or CreateUsers directly) without the password parameter, or with password: \"\" while iamUser is false/omitted.","commonSituations":"Tool configs where the password parameter was marked optional or omitted by the LLM; intending an IAM user but forgetting to pass iamUser: true; empty-string password from an unset environment variable.","solutions":["Supply a non-empty password parameter for BUILT_IN users.","If the account should authenticate via IAM, set iamUser: true so no password is required.","Fix the client/tool config so password is a required parameter for non-IAM users.","Check that the secret/env var feeding the password is actually set and non-empty."],"exampleFix":"// before\nCreateUsers(ctx, project, instance, \"appuser\", \"\", false, token)\n// after\nCreateUsers(ctx, project, instance, \"appuser\", \"s3curePass!\", false, token)\n// or for IAM auth:\nCreateUsers(ctx, project, instance, \"appuser\", \"\", true, token)","handlingStrategy":"validation","validationCode":"func validateUserParams(name, password string, iamUser bool) error {\n    if strings.TrimSpace(name) == \"\" {\n        return fmt.Errorf(\"user name is required\")\n    }\n    if !iamUser && strings.TrimSpace(password) == \"\" {\n        return fmt.Errorf(\"password is required for non-IAM (BUILT_IN) users\")\n    }\n    return nil\n}","typeGuard":"func needsPassword(iamUser bool) bool {\n    return !iamUser\n}","tryCatchPattern":"out, err := src.CreateUsers(ctx, project, instance, name, password, iamUser, token)\nif err != nil {\n    if strings.Contains(err.Error(), \"missing 'password' parameter\") {\n        return fmt.Errorf(\"client error: supply a password or set iamUser=true: %w\", err)\n    }\n    return fmt.Errorf(\"create user failed: %w\", err)\n}","preventionTips":["Mark the password parameter as required in the tool config for non-IAM flows.","Set iamUser: true when creating IAM-authenticated users.","Populate passwords from secrets managers, never hard-code, but verify non-empty before sending.","Validate all tool parameters in the calling client before invoking."],"tags":["validation","cloud-sql","missing-parameter","iam"],"backgroundTag":"missing-required-argument","analyzedSha":"8cc6e09de2ad7b8bffc77751799585a1401a48eb","analyzedAt":"2026-09-05T01:10:36.887Z","contentChangedAt":"2026-09-05T01:10:36.887Z","schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}