googleapis/mcp-toolbox · error

error getting email from ADC: %v

Error message

error getting email from ADC: %v

What it means

This error wraps a failure from sources.GetIAMPrincipalEmailFromADC, which uses Application Default Credentials (ADC) to resolve the IAM principal email of the ambient identity for AlloyDB IAM database authentication. When ADC cannot be obtained or cannot be exchanged for the principal email (missing credentials, bad quota project, disabled IAM APIs, revoked token), the source refuses to build the IAM DSN and returns this wrapped error. It is thrown from getConnectionConfig when neither username nor password is supplied, so IAM auth is implied.

Source

Thrown at internal/sources/alloydbpg/alloydb_pg.go:192

		userAgent = "genai-toolbox"
	}
	useIAM := true

	var dsn string
	// If username and password both provided, use password authentication
	if user != "" && pass != "" {
		dsn = fmt.Sprintf(passwordDSNFormat, user, pass, dbname, userAgent)
		useIAM = false
	} else if user == "" {
		// If username is empty, fetch email from ADC
		// otherwise, use username as IAM email
		if pass != "" {
			// If password is provided without an username, raise an error
			return "", useIAM, fmt.Errorf("password is provided without a username. Please provide both a username and password, or leave both fields empty")
		}
		email, err := sources.GetIAMPrincipalEmailFromADC(ctx, "postgres")
		if err != nil {
			return "", useIAM, fmt.Errorf("error getting email from ADC: %v", err)
		}
		user = email
		dsn = fmt.Sprintf(iamDSNFormat, user, dbname, userAgent)
	} else {
		// Construct IAM connection string with username
		dsn = fmt.Sprintf(iamDSNFormat, user, dbname, userAgent)
	}

	if readOnly {
		// IMPORTANT: Must use underscore ('alloydb_session_read_only'), NOT a dot.
		// PostgreSQL treats dotted GUCs (e.g. 'alloydb.session_read_only') as custom placeholders
		// and silently ignores them at connection time, leaving the session in read-write mode.
		dsn += " options='-c alloydb_session_read_only=locked'"
	}

	return dsn, useIAM, nil
}

View on GitHub (pinned to 8cc6e09de2)

Solutions

1. Run 'gcloud auth application-default login' locally, or set GOOGLE_APPLICATION_CREDENTIALS to a valid service-account key JSON.
2. Verify the runtime environment has an attached service account (VM service account, Cloud Run/Functions runtime SA) when relying on ambient credentials.
3. Ensure the identity has the IAM roles needed to resolve its email and connect to the AlloyDB instance (e.g. roles/alloydb.client, roles/serviceusage.serviceUsageConsumer).
4. Alternatively, explicitly provide both a username and password in the source config to bypass the ADC-based IAM path.
5. Check network access to the OAuth2/metadata endpoints (e.g. metadata.google.internal, oauth2.googleapis.com) from your environment.

Example fix

// before (IAM auth implied, no credentials available)
{"user": "", "pass": "", ...}
// after: either log in locally
$ gcloud auth application-default login
// or provide explicit credentials
{"user": "myuser", "pass": "mypassword", ...}

cred, err := google.FindDefaultCredentials(ctx)
if err != nil {
    return fmt.Errorf("ADC not available: %w; run 'gcloud auth application-default login'", err)
}

email, err := sources.GetIAMPrincipalEmailFromADC(ctx, "postgres")
if err != nil {
    log.Printf("IAM auth unavailable (%v); falling back to user/pass auth", err)
    return nil, err
}

When it happens

Trigger: Calling Initialize for the alloydbpg source with an empty user and empty pass (implying IAM auth) while Application Default Credentials are unavailable or unusable: GOOGLE_APPLICATION_CREDENTIALS points to a missing/invalid file, no gcloud ADC has been set up (gcloud auth application-default login never run), running on a machine with no metadata server, or the resolved credentials lack permission to get the IAM principal email.

Common situations: Local development without 'gcloud auth application-default login'; deploying to an environment where the service account is not attached (VM without scopes, Cloud Run without service account); CI pipelines with no credentials mounted; GOOGLE_APPLICATION_CREDENTIALS pointing to a service-account key that was deleted or rotated away; using a workload identity that lacks roles/serviceusage.serviceUsageConsumer or AlloyDB access.

Related errors

• failed to create impersonated credentials for %q: %w
• unable to create instance admin client: %w
• failed to create impersonated credentials for %q for project
• error creating AlloyDB instance: %w
• error creating AlloyDB user: %w

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/3f591ebc8b624645. Report an issue: GitHub.