invalid ScyllaDB configuration: password provided without a

Error message

invalid ScyllaDB configuration: password provided without a username

What it means

initScyllaDBSession validates authentication configuration before building the gocql cluster config. Providing a password without a username is rejected eagerly because gocql/CQL auth requires both an identity and a credential. This is a pure config validation error thrown before any network I/O.

Source

Thrown at internal/sources/scylladb/scylladb.go:143

		out = append(out, row)
	}

	if err := iter.Close(); err != nil {
		return nil, fmt.Errorf("failed to execute ScyllaDB query: %w", err)
	}
	return out, nil
}

var _ sources.Source = &Source{}

func initScyllaDBSession(ctx context.Context, tracer trace.Tracer, c Config) (*gocql.Session, error) {
	//nolint:all // Reassigned ctx
	ctx, span := sources.InitConnectionSpan(ctx, tracer, SourceType, c.Name)
	defer span.End()

	// Validate authentication configuration
	if c.Password != "" && c.Username == "" {
		return nil, fmt.Errorf("invalid ScyllaDB configuration: password provided without a username")
	}

	cluster := gocql.NewCluster(c.Hosts...)
	cluster.ProtoVersion = c.ProtoVersion
	cluster.Keyspace = c.Keyspace
	cluster.DisableInitialHostLookup = c.DisableInitialHostLookup

	// Configure DC-aware token-aware host selection policy.
	// This is required for ScyllaDB Cloud and recommended for all multi-DC
	// deployments to ensure queries are routed to the correct datacenter.
	if c.LocalDC != "" {
		cluster.PoolConfig.HostSelectionPolicy = gocql.TokenAwareHostPolicy(
			gocql.DCAwareRoundRobinPolicy(c.LocalDC),
		)
	}

	// Configure authentication if username is provided
	if c.Username != "" {

View on GitHub (pinned to 8cc6e09de2)

Solutions

Add the matching `username` field (default ScyllaDB superuser is `cassandra`).
If the server does not require auth, remove the `password` field entirely instead of leaving username blank.
Check YAML key spelling — it must be `username`, not `user` or `login`.

Example fix

// before
sources:
  scylla:
    kind: scylladb
    hosts: ["scylla:9042"]
    password: secret
// after
sources:
  scylla:
    kind: scylladb
    hosts: ["scylla:9042"]
    username: cassandra
    password: secret

Defensive patterns

Strategy: validation

Validate before calling

// Guard: password requires username (mirrors toolbox validation)
function validateScyllaConfig(cfg) {
  if (cfg.password && !cfg.username) {
    throw new Error('scylladb: password provided without username');
  }
}

Type guard

function hasPasswordWithoutUsername(cfg) {
  return typeof cfg.password === 'string' && cfg.password.length > 0 &&
         (typeof cfg.username !== 'string' || cfg.username.length === 0);
}

Prevention

Always set username and password together from the same secret store.
Use the exact YAML keys `username` and `password` — `user:` silently leaves username empty.
If auth is disabled on the cluster, omit both fields rather than only the username.
Lint deployment configs for this invariant before rollout.

When it happens

Trigger: A ScyllaDB source config sets `password` to a non-empty string while `username` is empty or omitted; Initialize → initScyllaDBSession returns this error immediately.

Common situations: Copy-pasting configs where only the password placeholder was filled; assuming password-only auth (Cassandra/ScyllaDB always requires a username, typically `cassandra` by default); YAML typo like `user:` instead of `username:` leaving username empty.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Related errors

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/2cdbdeb09cf0f6c8. Report an issue: GitHub.