{"record":{"id":"e636bed655023528","repo":"googleapis/mcp-toolbox","slug":"password-is-provided-without-a-username-please-pr-e636be","errorCode":null,"errorMessage":"password is provided without a username. Please provide both a username and password, or leave both fields empty","messagePattern":"password is provided without a username\\. Please provide both a username and password, or leave both fields empty","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/sources/cloudsqlpg/cloud_sql_pg.go","lineNumber":164,"sourceCode":"\nfunc getConnectionConfig(ctx context.Context, user, pass, dbname string, readOnly bool) (string, bool, error) {\n\tuserAgent, err := util.UserAgentFromContext(ctx)\n\tif err != nil {\n\t\tuserAgent = \"genai-toolbox\"\n\t}\n\tuseIAM := true\n\n\tvar dsn string\n\t// If username and password both provided, use password authentication\n\tif user != \"\" && pass != \"\" {\n\t\tdsn = fmt.Sprintf(\"user=%s password=%s dbname=%s sslmode=disable application_name=%s\", user, pass, dbname, userAgent)\n\t\tuseIAM = false\n\t} else if user == \"\" {\n\t\t// If username is empty, fetch email from ADC\n\t\t// otherwise, use username as IAM email\n\t\tif pass != \"\" {\n\t\t\t// If password is provided without an username, raise an error\n\t\t\treturn \"\", useIAM, fmt.Errorf(\"password is provided without a username. Please provide both a username and password, or leave both fields empty\")\n\t\t}\n\t\temail, err := sources.GetIAMPrincipalEmailFromADC(ctx, \"postgres\")\n\t\tif err != nil {\n\t\t\treturn \"\", useIAM, fmt.Errorf(\"error getting email from ADC: %v\", err)\n\t\t}\n\t\tuser = email\n\t\tdsn = fmt.Sprintf(\"user=%s dbname=%s sslmode=disable application_name=%s\", user, dbname, userAgent)\n\t} else {\n\t\t// Construct IAM connection string with username\n\t\tdsn = fmt.Sprintf(\"user=%s dbname=%s sslmode=disable application_name=%s\", user, dbname, userAgent)\n\t}\n\n\tif readOnly {\n\t\t// IMPORTANT: Must use underscore ('cloudsql_session_read_only'), NOT a dot.\n\t\t// PostgreSQL treats dotted GUCs (e.g. 'cloudsql.session_read_only') as custom placeholders\n\t\t// and silently ignores them at connection time, leaving the session in read-write mode.\n\t\tdsn += \" options='-c cloudsql_session_read_only=locked'\"\n\t}","sourceCodeStart":146,"sourceCodeEnd":182,"githubUrl":"https://github.com/googleapis/mcp-toolbox/blob/8cc6e09de2ad7b8bffc77751799585a1401a48eb/internal/sources/cloudsqlpg/cloud_sql_pg.go#L146-L182","documentation":"getConnectionConfig validates credential pairing for the Cloud SQL Postgres source. IAM-based auth requires either both user+password (password auth) or no credentials at all (ADC-derived IAM email). Supplying a password with no username is ambiguous and rejected outright during source initialization.","triggerScenarios":"Configuring the cloud-sql-postgres source YAML with a non-empty 'password' field and an empty 'user' field; Initialize then calls getConnectionConfig which fails before any connection is attempted.","commonSituations":"Copy-pasting a config template where user was left blank; intending IAM auth but also setting a legacy password; secrets injection where only the password env var resolves.","solutions":["Either set both 'user' and 'password' in the source config for password authentication.","Or remove 'password' entirely to use IAM auth with the ADC-derived principal email.","If IAM auth with a specific identity is desired, set 'user' to the IAM email (e.g. service account) and leave 'password' empty."],"exampleFix":"# before\nsources:\n  my-pg:\n    type: cloud-sql-postgres\n    password: hunter2\n# after\nsources:\n  my-pg:\n    type: cloud-sql-postgres\n    user: myuser\n    password: hunter2","handlingStrategy":"validation","validationCode":"// check the toolbox YAML before starting\nif (cfg.Password != \"\") != (cfg.User != \"\") && cfg.Password != \"\" {\n    return errors.New(\"password set without user: provide both or neither\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always set user and password as a pair in source configs","For IAM auth, leave both fields empty","Lint config files in CI for credential pairing","Use env-var substitution carefully so secrets resolve together"],"tags":["configuration","cloudsql","postgres","iam-auth","credentials"],"backgroundTag":"incomplete-credentials-config","analyzedSha":"8cc6e09de2ad7b8bffc77751799585a1401a48eb","analyzedAt":"2026-09-05T01:10:36.887Z","contentChangedAt":"2026-09-05T01:10:36.887Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}