googleapis/mcp-toolbox · error

username from ADC cannot be an empty string

Error message

username from ADC cannot be an empty string

What it means

After trimming the '.gserviceaccount.com' suffix from the ADC service account email, GetIAMPrincipalEmailFromADC requires a non-empty username. If the resolved ADC credentials have an empty or missing account email, the derived username would be empty and IAM auth would be meaningless, so the library rejects it with this error.

Source

Thrown at internal/sources/util.go:140

		return "", fmt.Errorf("email field is not a string")
	}

	var username string
	// Format the username based on Database Type
	switch strings.ToLower(dbType) {
	case "mysql":
		username, _, _ = strings.Cut(fullEmail, "@")

	case "postgres":
		// service account email used for IAM should trim the suffix
		username = strings.TrimSuffix(fullEmail, ".gserviceaccount.com")

	default:
		return "", fmt.Errorf("unsupported dbType: %s. Use 'mysql' or 'postgres'", dbType)
	}

	if username == "" {
		return "", fmt.Errorf("username from ADC cannot be an empty string")
	}

	return username, nil
}

func GetIAMAccessToken(ctx context.Context) (string, error) {
	creds, err := google.FindDefaultCredentials(ctx, "https://www.googleapis.com/auth/cloud-platform")
	if err != nil {
		return "", fmt.Errorf("failed to find default credentials (run 'gcloud auth application-default login'?): %w", err)
	}

	token, err := creds.TokenSource.Token() // This gets an oauth2.Token
	if err != nil {
		return "", fmt.Errorf("failed to get token from token source: %w", err)
	}

	if !token.Valid() {
		return "", fmt.Errorf("retrieved token is invalid or expired")

View on GitHub (pinned to 8cc6e09de2)

Solutions

1. Run 'gcloud auth application-default login' to set up valid ADC with an associated account
2. Verify the ADC JSON key file contains a non-empty 'client_email' field
3. Check GOOGLE_APPLICATION_CREDENTIALS points to a complete service account key file

Example fix

// before: ADC missing/anonymous
export GOOGLE_APPLICATION_CREDENTIALS=/path/to/broken.json
// after
export GOOGLE_APPLICATION_CREDENTIALS=/path/to/service-account-key.json # must contain client_email

import { google } from "googleapis";
const creds = await google.auth.getApplicationDefault();
if (!creds.credential?.email || creds.credential.email === "") {
  throw new Error("ADC has no service account email; run 'gcloud auth application-default login' or fix the key file");
}

function hasPrincipalEmail(c: { email?: string | null }): c is { email: string } {
  return typeof c.email === "string" && c.email.length > 0;
}

try {
  const email = await getIAMPrincipalEmailFromADC(ctx, dbType);
} catch (err) {
  if (String(err).includes("username from ADC cannot be an empty string")) {
    console.error("ADC lacks a service account email; re-run 'gcloud auth application-default login'");
  }
  throw err;
}

When it happens

Trigger: google.FindDefaultCredentials returns credentials whose principal email is empty or absent (e.g. credentials from a metadata source without an account, or ADC JSON lacking client_email) while configuring Cloud SQL IAM auth for mysql/postgres.

Common situations: Running locally without 'gcloud auth application-default login' so ADC falls back to a source without an email; a service account key file that is malformed or missing the client_email field; using workload metadata credentials where the service account email is not populated.

Related errors

• unsupported dbType: %s. Use 'mysql' or 'postgres'
• failed to find default credentials: %w
• error creating service from ADC: %w
• failed to find default Google Cloud credentials with scope %
• error getting email from ADC: %v

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/3d8668e48bb81bfd. Report an issue: GitHub.