elastic/elasticsearch · error · IllegalStateException

Basic Auth user [{}] has been set, but no password has been

Error message

Basic Auth user [{}] has been set, but no password has been configured

What it means

WaitForHttpResource.configureBasicAuth() throws when a `username` is set but `password` is null. Basic Auth requires both halves; a username alone is always wrong and would produce a malformed Authorization header, so the build fails fast rather than sending a half-empty credential.

Source

Thrown at build-tools/src/main/java/org/elasticsearch/gradle/testclusters/WaitForHttpResource.java:150

        configureBasicAuth(connection);
        connection.setRequestMethod("GET");
        return connection;
    }

    private void configureSslContext(HttpURLConnection connection, SSLContext ssl) {
        if (ssl != null) {
            if (connection instanceof HttpsURLConnection) {
                ((HttpsURLConnection) connection).setSSLSocketFactory(ssl.getSocketFactory());
            } else {
                throw new IllegalStateException("SSL trust has been configured, but [" + url + "] is not a 'https' URL");
            }
        }
    }

    private void configureBasicAuth(HttpURLConnection connection) {
        if (username != null) {
            if (password == null) {
                throw new IllegalStateException("Basic Auth user [" + username + "] has been set, but no password has been configured");
            }
            connection.setRequestProperty(
                "Authorization",
                "Basic " + Base64.getEncoder().encodeToString((username + ":" + password).getBytes(StandardCharsets.UTF_8))
            );
        }
    }
}

View on GitHub (pinned to db6a809a66)

Solutions

Set both username and password: `waitResource.username='elastic-admin'; waitResource.password='elastic-password'` (or use the credentials helper).
If the password comes from a gradle property, ensure the property is set (`-Pes.password=...`) or supply a default.
If the cluster has security disabled, clear the username too — no auth needed.

Example fix

// before
waitResource.username = 'elastic-admin'
// password forgotten
// after
waitResource.username = 'elastic-admin'
waitResource.password = 'elastic-password'

Defensive patterns

Strategy: validation

Validate before calling

if (username != null && password == null) {
  throw new IllegalStateException(
    "Username " + username + " set without password; pass both or neither.");
}

Prevention

Always set username and password together, ideally via a single `credentials(u, p)` helper.
When sourcing the password from a gradle property, supply a default or fail fast if unset.
If security is off, clear the username too.

When it happens

Trigger: Calling `.credentials(username, null)` or setting `.username = 'x'` without a corresponding password on a WaitForHttpResource used to poll a secured cluster.

Common situations: Security enabled on the cluster (default dev creds `elastic-admin:elastic-password`) but only the username was wired; password sourced from a Provider/property that resolved to null (e.g. `project.findProperty('es.password')` with the property unset); refactoring that moved the password assignment but missed this resource.

Related errors

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/38709c73fcefad4d. Report an issue: GitHub.