googleapis/mcp-toolbox · error

error getting email from ADC: %v

Error message

error getting email from ADC: %v

What it means

When no username is configured, the source derives the IAM principal email from Application Default Credentials via GetIAMPrincipalEmailFromADC (dialect 'postgres') and uses it as the Postgres user. If ADC are missing, invalid, or lack token scopes, this error is wrapped and the pool initialization aborts.

Source

Thrown at internal/sources/cloudsqlpg/cloud_sql_pg.go:168

		userAgent = "genai-toolbox"
	}
	useIAM := true

	var dsn string
	// If username and password both provided, use password authentication
	if user != "" && pass != "" {
		dsn = fmt.Sprintf("user=%s password=%s dbname=%s sslmode=disable application_name=%s", user, pass, dbname, userAgent)
		useIAM = false
	} else if user == "" {
		// If username is empty, fetch email from ADC
		// otherwise, use username as IAM email
		if pass != "" {
			// If password is provided without an username, raise an error
			return "", useIAM, fmt.Errorf("password is provided without a username. Please provide both a username and password, or leave both fields empty")
		}
		email, err := sources.GetIAMPrincipalEmailFromADC(ctx, "postgres")
		if err != nil {
			return "", useIAM, fmt.Errorf("error getting email from ADC: %v", err)
		}
		user = email
		dsn = fmt.Sprintf("user=%s dbname=%s sslmode=disable application_name=%s", user, dbname, userAgent)
	} else {
		// Construct IAM connection string with username
		dsn = fmt.Sprintf("user=%s dbname=%s sslmode=disable application_name=%s", user, dbname, userAgent)
	}

	if readOnly {
		// IMPORTANT: Must use underscore ('cloudsql_session_read_only'), NOT a dot.
		// PostgreSQL treats dotted GUCs (e.g. 'cloudsql.session_read_only') as custom placeholders
		// and silently ignores them at connection time, leaving the session in read-write mode.
		dsn += " options='-c cloudsql_session_read_only=locked'"
	}

	return dsn, useIAM, nil
}

View on GitHub (pinned to 8cc6e09de2)

Solutions

1. Run 'gcloud auth application-default login' locally, or set GOOGLE_APPLICATION_CREDENTIALS to a valid service-account key.
2. Grant the identity the roles/cloudsql.client IAM role so it can authenticate to the instance.
3. Alternatively, set explicit 'user' and 'password' fields to bypass ADC email lookup.
4. In GKE/Cloud Run, ensure workload identity / service account attachment is configured correctly.

Example fix

// before: gcloud auth application-default login not run
// after:
//   gcloud auth application-default login
// or set GOOGLE_APPLICATION_CREDENTIALS=/path/to/sa-key.json

tok, err := google.FindDefaultCredentials(ctx)
if err != nil {
    return fmt.Errorf("ADC unavailable: run 'gcloud auth application-default login' or set GOOGLE_APPLICATION_CREDENTIALS")
}

When it happens

Trigger: Initializing a cloud-sql-postgres source with empty 'user' and 'password' fields while Application Default Credentials are unavailable (no GOOGLE_APPLICATION_CREDENTIALS, no gcloud auth, or metadata server inaccessible).

Common situations: Running the toolbox locally without 'gcloud auth application-default login'; CI/container without a mounted service-account key; workload identity not configured; service account lacking the Cloud SQL Client role; ADC JSON corrupted or expired.

Related errors

• error creating client from ADC: %w
• password is provided without a username. Please provide both
• failed to find default Google Cloud credentials with scope %
• failed to find default Google Cloud credentials with scope %
• failed to find default Google Cloud credentials: %w

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/a081c9d1ed78d57b. Report an issue: GitHub.