risingwavelabs/risingwave · error · SinkError::Config

please set the password when the username is set.

Error message

please set the password when the username is set.

What it means

build_client validates that credentials come in pairs: when a username is configured but no password, constructing HTTP Basic auth would be incomplete, so client creation is rejected with this config error.

Source

Thrown at src/connector/src/sink/elasticsearch_opensearch/elasticsearch_opensearch_config.rs:193

            serde_json::from_value::<OpenSearchConfig>(serde_json::to_value(properties).unwrap())
                .map_err(|e| SinkError::Config(anyhow!(e)))?;
        Ok(config)
    }
}

impl ElasticSearchOpenSearchConfig {
    pub fn from_btreemap(properties: BTreeMap<String, String>) -> Result<Self> {
        let config = serde_json::from_value::<ElasticSearchOpenSearchConfig>(
            serde_json::to_value(properties).unwrap(),
        )
        .map_err(|e| SinkError::Config(anyhow!(e)))?;
        Ok(config)
    }

    pub fn build_client(&self, connector: &str) -> Result<ElasticSearchOpenSearchClient> {
        let check_username_password = || -> Result<()> {
            if self.username.is_some() && self.password.is_none() {
                return Err(SinkError::Config(anyhow!(
                    "please set the password when the username is set."
                )));
            }
            if self.username.is_none() && self.password.is_some() {
                return Err(SinkError::Config(anyhow!(
                    "please set the username when the password is set."
                )));
            }
            Ok(())
        };
        let url =
            Url::parse(&self.url).map_err(|e| SinkError::ElasticSearchOpenSearch(anyhow!(e)))?;
        if connector.eq(ES_SINK) {
            let mut transport_builder = elasticsearch::http::transport::TransportBuilder::new(
                elasticsearch::http::transport::SingleNodeConnectionPool::new(url),
            );
            if let Some(username) = &self.username
                && let Some(password) = &self.password

View on GitHub (pinned to 6469eb736d)

Solutions

1. Add the matching `password` alongside `username` in the sink/connection options.
2. If the endpoint allows anonymous access, remove both username and password.
3. Verify referenced secrets resolve to non-empty values.

Example fix

// before
WITH (
  'connector' = 'elasticsearch',
  'url' = 'https://es.example.com:9200',
  'username' = 'elastic'
)
// after
WITH (
  'connector' = 'elasticsearch',
  'url' = 'https://es.example.com:9200',
  'username' = 'elastic',
  'password' = 'secret'
)

-- assert paired credentials before DDL
-- WITH clause must contain both 'username' and 'password' or neither

match err { SinkError::Config(e) if e.to_string().contains("password when the username") => add_password_option(), _ => return Err(err) }

When it happens

Trigger: Creating an Elasticsearch/OpenSearch sink (or connection) whose config has `username` set but `password` unset; build_client is called by new during sink creation.

Common situations: Omitting the password line from the WITH clause; password supplied via a secret/environment variable that resolved to nothing; copy-paste that dropped the password key.

Related errors

• please set the username when the password is set.
• Invalid field: {}, allowed fields: {:?}
• Url::parse error: {e}
• Cannot find {}
• unrecognized configs: {:?}

AI-assisted analysis of risingwavelabs/risingwave@6469eb736d (2026-09-11). Data as JSON: /api/errors/5805d8c3c654f3de. Report an issue: GitHub.