googleapis/mcp-toolbox · error

password is provided without a username. Please provide both

Error message

password is provided without a username. Please provide both a username and password, or leave both fields empty

What it means

getConnectionConfig validates credential pairing for the Cloud SQL Postgres source. IAM-based auth requires either both user+password (password auth) or no credentials at all (ADC-derived IAM email). Supplying a password with no username is ambiguous and rejected outright during source initialization.

Source

Thrown at internal/sources/cloudsqlpg/cloud_sql_pg.go:164

func getConnectionConfig(ctx context.Context, user, pass, dbname string, readOnly bool) (string, bool, error) {
	userAgent, err := util.UserAgentFromContext(ctx)
	if err != nil {
		userAgent = "genai-toolbox"
	}
	useIAM := true

	var dsn string
	// If username and password both provided, use password authentication
	if user != "" && pass != "" {
		dsn = fmt.Sprintf("user=%s password=%s dbname=%s sslmode=disable application_name=%s", user, pass, dbname, userAgent)
		useIAM = false
	} else if user == "" {
		// If username is empty, fetch email from ADC
		// otherwise, use username as IAM email
		if pass != "" {
			// If password is provided without an username, raise an error
			return "", useIAM, fmt.Errorf("password is provided without a username. Please provide both a username and password, or leave both fields empty")
		}
		email, err := sources.GetIAMPrincipalEmailFromADC(ctx, "postgres")
		if err != nil {
			return "", useIAM, fmt.Errorf("error getting email from ADC: %v", err)
		}
		user = email
		dsn = fmt.Sprintf("user=%s dbname=%s sslmode=disable application_name=%s", user, dbname, userAgent)
	} else {
		// Construct IAM connection string with username
		dsn = fmt.Sprintf("user=%s dbname=%s sslmode=disable application_name=%s", user, dbname, userAgent)
	}

	if readOnly {
		// IMPORTANT: Must use underscore ('cloudsql_session_read_only'), NOT a dot.
		// PostgreSQL treats dotted GUCs (e.g. 'cloudsql.session_read_only') as custom placeholders
		// and silently ignores them at connection time, leaving the session in read-write mode.
		dsn += " options='-c cloudsql_session_read_only=locked'"
	}

View on GitHub (pinned to 8cc6e09de2)

Solutions

1. Either set both 'user' and 'password' in the source config for password authentication.
2. Or remove 'password' entirely to use IAM auth with the ADC-derived principal email.
3. If IAM auth with a specific identity is desired, set 'user' to the IAM email (e.g. service account) and leave 'password' empty.

Example fix

# before
sources:
  my-pg:
    type: cloud-sql-postgres
    password: hunter2
# after
sources:
  my-pg:
    type: cloud-sql-postgres
    user: myuser
    password: hunter2

// check the toolbox YAML before starting
if (cfg.Password != "") != (cfg.User != "") && cfg.Password != "" {
    return errors.New("password set without user: provide both or neither")
}

When it happens

Trigger: Configuring the cloud-sql-postgres source YAML with a non-empty 'password' field and an empty 'user' field; Initialize then calls getConnectionConfig which fails before any connection is attempted.

Common situations: Copy-pasting a config template where user was left blank; intending IAM auth but also setting a legacy password; secrets injection where only the password env var resolves.

Related errors

• unable to get Cloud SQL connection config: %w
• error getting email from ADC: %v
• unable to parse connection uri: %w
• unable to parse connection uri: %w
• invalid source for %q tool: source %q is not a compatible ty

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/e636bed655023528. Report an issue: GitHub.