invalid Cassandra configuration: password provided without a

Error message

invalid Cassandra configuration: password provided without a username

What it means

initCassandraSession validates auth configuration before connecting. Providing a Password with an empty Username is treated as a misconfiguration and rejected immediately with this static message.

Source

Thrown at internal/sources/cassandra/cassandra.go:132

		out = append(out, row)
	}

	if err := iter.Close(); err != nil {
		return nil, fmt.Errorf("unable to parse rows: %w", err)
	}
	return out, nil
}

var _ sources.Source = &Source{}

func initCassandraSession(ctx context.Context, tracer trace.Tracer, c Config) (*gocql.Session, error) {
	//nolint:all // Reassigned ctx
	ctx, span := sources.InitConnectionSpan(ctx, tracer, SourceType, c.Name)
	defer span.End()

	// Validate authentication configuration
	if c.Password != "" && c.Username == "" {
		return nil, fmt.Errorf("invalid Cassandra configuration: password provided without a username")
	}

	cluster := gocql.NewCluster(c.Hosts...)
	cluster.ProtoVersion = c.ProtoVersion
	cluster.Keyspace = c.Keyspace

	// Configure authentication if username is provided
	if c.Username != "" {
		cluster.Authenticator = gocql.PasswordAuthenticator{
			Username: c.Username,
			Password: c.Password,
		}
	}

	// Configure SSL options if any are specified
	if c.CAPath != "" || c.CertPath != "" || c.KeyPath != "" || c.EnableHostVerification {
		cluster.SslOpts = &gocql.SslOptions{
			CaPath:                 c.CAPath,

View on GitHub (pinned to 8cc6e09de2)

Solutions

Set the Username field alongside Password in the config.
Check the YAML/config keys are spelled correctly so the username is parsed.
If the cluster truly needs no auth, remove the Password too.
Add a config sanity check in your deployment pipeline.

Example fix

// before
c := cassandra.Config{Hosts: hosts, Password: "secret"}
// after
c := cassandra.Config{Hosts: hosts, Username: "cassandra", Password: "secret"}

Defensive patterns

Strategy: validation

Validate before calling

if cfg.Password != "" && cfg.Username == "" {
    return errors.New("password provided without a username")
}

Try / catch

_, err := cfg.Initialize(ctx, tracer)
if err != nil && strings.Contains(err.Error(), "invalid Cassandra configuration") {
    // fix config, do not retry
}

Prevention

Always set username and password together.
Validate config fields before passing to Initialize.
Use config templates/tests that enforce both fields.

When it happens

Trigger: Constructing cassandra.Config with Password set but Username empty, then calling Initialize.

Common situations: Config YAML missing the username field, env var not wired into username, password-only auth assumed (Cassandra requires both).

Related errors

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/934e7f5d04d7eca1. Report an issue: GitHub.