risingwavelabs/risingwave · error · SinkError::Config

no authentication configured: set either `password`, or `pri

Error message

no authentication configured: set either `password`, or `private_key_file`, or `private_key_pem` (or provide `auth.method`)

What it means

With no explicit `auth.method`, the Snowflake sink infers authentication from credential fields. If none of `password`, `private_key_file`, or `private_key_pem` is present, no authentication can be configured and the connector fails fast during sink construction.

Source

Thrown at src/connector/src/sink/snowflake_redshift/snowflake.rs:343

            Some(other) => {
                return Err(SinkError::Config(anyhow!(
                    "invalid auth.method: {} (allowed: password | key_pair_file | key_pair_object)",
                    other
                )));
            }
            None => {
                // Infer auth method from supplied fields
                match (has_password, has_file, has_pem) {
                    (true, false, false) => AUTH_METHOD_PASSWORD.to_owned(),
                    (false, true, false) => AUTH_METHOD_KEY_PAIR_FILE.to_owned(),
                    (false, false, true) => AUTH_METHOD_KEY_PAIR_OBJECT.to_owned(),
                    (true, true, _) | (true, _, true) | (false, true, true) => {
                        return Err(SinkError::Config(anyhow!(
                            "ambiguous auth: multiple auth options provided; remove one or set `auth.method`"
                        )));
                    }
                    _ => {
                        return Err(SinkError::Config(anyhow!(
                            "no authentication configured: set either `password`, or `private_key_file`, or `private_key_pem` (or provide `auth.method`)"
                        )));
                    }
                }
            }
        };
        config.auth_method = Some(normalized_auth_method);
        Ok(config)
    }

    pub fn build_snowflake_task_ctx_jdbc_client(
        &self,
        is_append_only: bool,
        schema: &Schema,
        pk_indices: &Vec<usize>,
    ) -> Result<Option<(SnowflakeTaskContext, JdbcJniClient)>> {
        if !self.auto_schema_change
            && is_append_only

View on GitHub (pinned to 6469eb736d)

Solutions

1. Add one credential option: `password`, `private_key_file`, or `private_key_pem`.
2. Or set `auth.method` together with its required credential fields.
3. Check that any secret/variable interpolation actually produced a non-empty value.

Example fix

// before
WITH (
  connector = 'snowflake',
  snowflake.account = 'xy12345',
  user = 'myuser'
)
// after
WITH (
  connector = 'snowflake',
  snowflake.account = 'xy12345',
  user = 'myuser',
  password = 'secret'
)

const creds = ['password', 'private_key_file', 'private_key_pem'].filter(k => opts[k]);
if (creds.length === 0 && !opts['auth.method']) {
  throw new Error('No Snowflake credentials configured');
}

When it happens

Trigger: CREATE SINK for a Snowflake sink that supplies connection details (account, user, database, etc.) but no credential option and no `auth.method`.

Common situations: Forgetting the password/key option, or credentials expected via templated variables that resolved to empty, or copying a minimal example that omitted auth.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• auth.method=key_pair_object must not set `password`
• invalid auth.method: {} (allowed: password | key_pair_file |
• ambiguous auth: multiple auth options provided; remove one o
• feature {feature:?} is not available based on your license
• Snowflake catalog only supports iceberg sources

AI-assisted analysis of risingwavelabs/risingwave@6469eb736d (2026-09-11). Data as JSON: /api/errors/05dd580f072ab902. Report an issue: GitHub.