risingwavelabs/risingwave · error · SinkError::Config

ambiguous auth: multiple auth options provided; remove one o

Error message

ambiguous auth: multiple auth options provided; remove one or set `auth.method`

What it means

When `auth.method` is not set, the Snowflake sink infers the auth method from which credential fields are present. If more than one of `password`, `private_key_file`, and `private_key_pem` is supplied, the method is ambiguous and the connector refuses to guess.

Source

Thrown at src/connector/src/sink/snowflake_redshift/snowflake.rs:338

                        "auth.method=key_pair_object must not set `password`"
                    )));
                }
                AUTH_METHOD_KEY_PAIR_OBJECT.to_owned()
            }
            Some(other) => {
                return Err(SinkError::Config(anyhow!(
                    "invalid auth.method: {} (allowed: password | key_pair_file | key_pair_object)",
                    other
                )));
            }
            None => {
                // Infer auth method from supplied fields
                match (has_password, has_file, has_pem) {
                    (true, false, false) => AUTH_METHOD_PASSWORD.to_owned(),
                    (false, true, false) => AUTH_METHOD_KEY_PAIR_FILE.to_owned(),
                    (false, false, true) => AUTH_METHOD_KEY_PAIR_OBJECT.to_owned(),
                    (true, true, _) | (true, _, true) | (false, true, true) => {
                        return Err(SinkError::Config(anyhow!(
                            "ambiguous auth: multiple auth options provided; remove one or set `auth.method`"
                        )));
                    }
                    _ => {
                        return Err(SinkError::Config(anyhow!(
                            "no authentication configured: set either `password`, or `private_key_file`, or `private_key_pem` (or provide `auth.method`)"
                        )));
                    }
                }
            }
        };
        config.auth_method = Some(normalized_auth_method);
        Ok(config)
    }

    pub fn build_snowflake_task_ctx_jdbc_client(
        &self,
        is_append_only: bool,

View on GitHub (pinned to 6469eb736d)

Solutions

1. Remove all but one credential option (`password`, `private_key_file`, or `private_key_pem`).
2. Or explicitly set `auth.method` to the intended method so the connector knows which credential to use.
3. Audit the sink definition (and any templating/variables) for leftover credential fields.

Example fix

// before
WITH (
  connector = 'snowflake',
  password = 'secret',
  private_key_file = '/path/key.p8'
)
// after
WITH (
  connector = 'snowflake',
  auth.method = 'key_pair_file',
  private_key_file = '/path/key.p8'
)

const creds = ['password', 'private_key_file', 'private_key_pem'].filter(k => opts[k]);
if (creds.length > 1 && !opts['auth.method']) {
  throw new Error(`Ambiguous auth: multiple creds set (${creds})`);
}

When it happens

Trigger: Calling `from_btreemap` (CREATE SINK) without `auth.method` while providing two or more of: `password`, `private_key_file`, `private_key_pem`.

Common situations: Merging sink definitions or migrating from password auth to key-pair auth while leaving both credential options in the WITH clause.

Understand the failure class

Background: Conflicting config options: "cannot be used together" — configuration validation errors across open-source libraries — this error's family across 162 libraries.

Related errors

• auth.method=key_pair_object must not set `password`
• intermediate.table.name is required for non-append-only sink
• invalid auth.method: {} (allowed: password | key_pair_file |
• no authentication configured: set either `password`, or `pri
• table.name is required

AI-assisted analysis of risingwavelabs/risingwave@6469eb736d (2026-09-11). Data as JSON: /api/errors/a1c57a837d480dab. Report an issue: GitHub.