risingwavelabs/risingwave · error · SinkError

please set the username when the password is set.

Error message

please set the username when the password is set.

What it means

Configuration check in ElasticSearchOpenSearchConfig::build_client: a password was provided without a username. Both must be set together for basic-authenticated clients; a password-only configuration is rejected before creating the Elasticsearch/OpenSearch client.

Source

Thrown at src/connector/src/sink/elasticsearch_opensearch/elasticsearch_opensearch_config.rs:198

impl ElasticSearchOpenSearchConfig {
    pub fn from_btreemap(properties: BTreeMap<String, String>) -> Result<Self> {
        let config = serde_json::from_value::<ElasticSearchOpenSearchConfig>(
            serde_json::to_value(properties).unwrap(),
        )
        .map_err(|e| SinkError::Config(anyhow!(e)))?;
        Ok(config)
    }

    pub fn build_client(&self, connector: &str) -> Result<ElasticSearchOpenSearchClient> {
        let check_username_password = || -> Result<()> {
            if self.username.is_some() && self.password.is_none() {
                return Err(SinkError::Config(anyhow!(
                    "please set the password when the username is set."
                )));
            }
            if self.username.is_none() && self.password.is_some() {
                return Err(SinkError::Config(anyhow!(
                    "please set the username when the password is set."
                )));
            }
            Ok(())
        };
        let url =
            Url::parse(&self.url).map_err(|e| SinkError::ElasticSearchOpenSearch(anyhow!(e)))?;
        if connector.eq(ES_SINK) {
            let mut transport_builder = elasticsearch::http::transport::TransportBuilder::new(
                elasticsearch::http::transport::SingleNodeConnectionPool::new(url),
            );
            if let Some(username) = &self.username
                && let Some(password) = &self.password
            {
                transport_builder = transport_builder.auth(
                    elasticsearch::auth::Credentials::Basic(username.clone(), password.clone()),
                );
            }

View on GitHub (pinned to 6469eb736d)

Solutions

1. Add the matching `username` alongside `password`.
2. Verify the username option key is spelled exactly `username`.
3. Remove the password if the cluster is unauthenticated.

Example fix

// before
WITH (
  'connector' = 'elasticsearch',
  'url' = 'https://es.example.com:9200',
  'password' = 'secret'
)
// after
WITH (
  'connector' = 'elasticsearch',
  'url' = 'https://es.example.com:9200',
  'username' = 'elastic',
  'password' = 'secret'
)

-- assert paired credentials before DDL
-- WITH clause must contain both 'username' and 'password' or neither

match err { SinkError::Config(e) if e.to_string().contains("username when the password") => add_username_option(), _ => return Err(err) }

When it happens

Trigger: Sink/connection config contains `password` but no `username` when new() calls build_client.

Common situations: Username key typo (e.g. `user` instead of `username`); partially edited sink definitions; assuming password-only auth is supported.

Related errors

• please set the password when the username is set.
• Invalid field: {}, allowed fields: {:?}
• Url::parse error: {e}
• Cannot find {}
• unrecognized configs: {:?}

AI-assisted analysis of risingwavelabs/risingwave@6469eb736d (2026-09-11). Data as JSON: /api/errors/1c4d1652581c50f8. Report an issue: GitHub.