{"id":"e916dd07b5982d81","repo":"mongodb/node-mongodb-native","slug":"invalid-source-this-source-for-mechanism-t","errorCode":null,"errorMessage":"Invalid source '${this.source}' for mechanism '${this.mechanism}' specified.","messagePattern":"Invalid source '(.+?)' for mechanism '(.+?)' specified\\.","errorType":"validation","errorClass":"MongoAPIError","httpStatus":null,"severity":"error","filePath":"src/cmap/auth/mongo_credentials.ts","lineNumber":253,"sourceCode":"      }\n\n      if (this.mechanismProperties.ALLOWED_HOSTS) {\n        const hosts = this.mechanismProperties.ALLOWED_HOSTS;\n        if (!Array.isArray(hosts)) {\n          throw new MongoInvalidArgumentError(ALLOWED_HOSTS_ERROR);\n        }\n        for (const host of hosts) {\n          if (typeof host !== 'string') {\n            throw new MongoInvalidArgumentError(ALLOWED_HOSTS_ERROR);\n          }\n        }\n      }\n    }\n\n    if (AUTH_MECHS_AUTH_SRC_EXTERNAL.has(this.mechanism)) {\n      if (this.source != null && this.source !== '$external') {\n        // TODO(NODE-3485): Replace this with a MongoAuthValidationError\n        throw new MongoAPIError(\n          `Invalid source '${this.source}' for mechanism '${this.mechanism}' specified.`\n        );\n      }\n    }\n\n    if (this.mechanism === AuthMechanism.MONGODB_PLAIN && this.source == null) {\n      // TODO(NODE-3485): Replace this with a MongoAuthValidationError\n      throw new MongoAPIError('PLAIN Authentication Mechanism needs an auth source');\n    }\n\n    if (this.mechanism === AuthMechanism.MONGODB_X509 && this.password != null) {\n      if (this.password === '') {\n        Reflect.set(this, 'password', undefined);\n        return;\n      }\n      // TODO(NODE-3485): Replace this with a MongoAuthValidationError\n      throw new MongoAPIError(`Password not allowed for mechanism MONGODB-X509`);\n    }","sourceCodeStart":235,"sourceCodeEnd":271,"githubUrl":"https://github.com/mongodb/node-mongodb-native/blob/3366c21a6311e02f1be91da982f9b93d3cce99a0/src/cmap/auth/mongo_credentials.ts#L235-L271","documentation":"Thrown when an explicit authSource is set to anything other than '$external' for a mechanism that uses the external database (GSSAPI, AWS, OIDC, X509). These mechanisms always authenticate against '$external'; specifying 'admin' or any db name is invalid. The driver surfaces this as a MongoAPIError during credential validation.","triggerScenarios":"In MongoCredentials.validate() when AUTH_MECHS_AUTH_SRC_EXTERNAL.has(mechanism) and source is set and !== '$external'.","commonSituations":"Migrating a SCRAM connection string that had authSource=admin and just changing authMechanism to MONGODB-X509/GSSAPI/AWS/OIDC; setting authSource in code while forgetting the external rule; misconfigured ops template.","solutions":["Remove authSource for these mechanisms, or set it explicitly to '$external'.","Update connection string to '.../?authMechanism=MONGODB-X509&authSource=$external'.","Fix any infra config templating that hard-codes authSource=admin."],"exampleFix":"// before\n'mongodb://host/?authMechanism=MONGODB-X509&authSource=admin'\n\n// after\n'mongodb://host/?authMechanism=MONGODB-X509&authSource=$external'","handlingStrategy":"validation","validationCode":"const EXTERNAL_MECHS = new Set(['GSSAPI','MONGODB-AWS','MONGODB-OIDC','MONGODB-X509']);\nfunction validateAuthSource(mechanism: string, source?: string) {\n  if (EXTERNAL_MECHS.has(mechanism) && source && source !== '$external') {\n    throw new Error(`authSource must be '$external' for ${mechanism}`);\n  }\n}","typeGuard":"import { MongoAPIError } from 'mongodb';\nfunction isInvalidSource(e: unknown): boolean {\n  return e instanceof MongoAPIError && /Invalid source/.test(e.message);\n}","tryCatchPattern":null,"preventionTips":["Omit authSource for external mechanisms, or set it to '$external'.","Templatize connection strings per mechanism family."],"tags":["auth","credentials","configuration","x509","gssapi","aws","oidc"],"analyzedSha":"3366c21a6311e02f1be91da982f9b93d3cce99a0","analyzedAt":"2026-08-04T13:40:15.335Z","schemaVersion":2}