{"id":"e42842f61cd6c690","repo":"mongodb/node-mongodb-native","slug":"no-password-is-allowed-in-environment-this-mech","errorCode":null,"errorMessage":"No password is allowed in ENVIRONMENT '${this.mechanismProperties.ENVIRONMENT}' for '${this.mechanism}'.","messagePattern":"No password is allowed in ENVIRONMENT '(.+?)' for '(.+?)'\\.","errorType":"validation","errorClass":"MongoInvalidArgumentError","httpStatus":null,"severity":"error","filePath":"src/cmap/auth/mongo_credentials.ts","lineNumber":203,"sourceCode":"        this.mechanism === AuthMechanism.MONGODB_SCRAM_SHA256) &&\n      !this.username\n    ) {\n      throw new MongoMissingCredentialsError(`Username required for mechanism '${this.mechanism}'`);\n    }\n\n    if (this.mechanism === AuthMechanism.MONGODB_OIDC) {\n      if (\n        this.username &&\n        this.mechanismProperties.ENVIRONMENT &&\n        this.mechanismProperties.ENVIRONMENT !== 'azure'\n      ) {\n        throw new MongoInvalidArgumentError(\n          `username and ENVIRONMENT '${this.mechanismProperties.ENVIRONMENT}' may not be used together for mechanism '${this.mechanism}'.`\n        );\n      }\n\n      if (this.username && this.password) {\n        throw new MongoInvalidArgumentError(\n          `No password is allowed in ENVIRONMENT '${this.mechanismProperties.ENVIRONMENT}' for '${this.mechanism}'.`\n        );\n      }\n\n      if (\n        (this.mechanismProperties.ENVIRONMENT === 'azure' ||\n          this.mechanismProperties.ENVIRONMENT === 'gcp') &&\n        !this.mechanismProperties.TOKEN_RESOURCE\n      ) {\n        throw new MongoInvalidArgumentError(TOKEN_RESOURCE_MISSING_ERROR);\n      }\n\n      if (\n        this.mechanismProperties.ENVIRONMENT &&\n        !ALLOWED_ENVIRONMENT_NAMES.includes(this.mechanismProperties.ENVIRONMENT)\n      ) {\n        throw new MongoInvalidArgumentError(\n          `Currently only a ENVIRONMENT in ${ALLOWED_ENVIRONMENT_NAMES.join(","sourceCodeStart":185,"sourceCodeEnd":221,"githubUrl":"https://github.com/mongodb/node-mongodb-native/blob/3366c21a6311e02f1be91da982f9b93d3cce99a0/src/cmap/auth/mongo_credentials.ts#L185-L221","documentation":"Thrown for MONGODB-OIDC when both username and password are set. OIDC is a token-based mechanism; supplying a password is invalid. (Note: the message references ENVIRONMENT but the check fires for any OIDC config with username+password; ENVIRONMENT may be undefined in the rendered message.)","triggerScenarios":"In MongoCredentials.validate() OIDC branch when this.username && this.password are both truthy.","commonSituations":"Reusing a SCRAM-style connection string (username:password) and just flipping authMechanism to MONGODB-OIDC; migrating from SCRAM to OIDC without removing the password.","solutions":["Remove the password from the connection string / credentials when using MONGODB-OIDC.","Keep only the username if ENVIRONMENT=azure (as client_id), or remove both for machine workflows.","Re-issue the connection string without the ':password' segment."],"exampleFix":"// before\n// 'mongodb://user:pass@host/?authMechanism=MONGODB-OIDC'\n\n// after\n// 'mongodb://host/?authMechanism=MONGODB-OIDC&authMechanismProperties=OIDC_CALLBACK:...'  // or ENVIRONMENT-based","handlingStrategy":"validation","validationCode":"function validateOidc(opts: { username?: string; password?: string; mechanism?: string }) {\n  if (opts.mechanism === 'MONGODB-OIDC' && opts.username && opts.password) {\n    throw new Error('Password is not allowed for MONGODB-OIDC');\n  }\n}","typeGuard":"import { MongoInvalidArgumentError } from 'mongodb';\nfunction isOidcPasswordForbidden(e: unknown): boolean {\n  return e instanceof MongoInvalidArgumentError && /No password is allowed/.test(e.message);\n}","tryCatchPattern":null,"preventionTips":["When migrating SCRAM->OIDC, strip the password entirely.","Treat OIDC config as token-based; never include plaintext passwords."],"tags":["auth","oidc","credentials","configuration"],"analyzedSha":"3366c21a6311e02f1be91da982f9b93d3cce99a0","analyzedAt":"2026-08-04T13:40:15.335Z","schemaVersion":2}