t8y2/dbx · error

password is required

Error message

password is required

What it means

createUser requires a 'password' parameter when creating or modifying a RabbitMQ user, because the management API PUT /api/users/{name} needs a password (or password_hash) to authenticate the user. The library rejects the call before contacting the server when password is an empty string. Note the check is password == "" (no trim), so whitespace technically passes.

Source

Thrown at agents/drivers/rabbitmq/operations.go:799

func parseUserTags(tags string) []string {
	result := make([]string, 0)
	for _, tag := range strings.Split(tags, ",") {
		if trimmed := strings.TrimSpace(tag); trimmed != "" {
			result = append(result, trimmed)
		}
	}
	return result
}

func (s *server) createUser(params jsonObject) (any, error) {
	name, err := userName(params)
	if err != nil {
		return nil, err
	}
	password := stringOrEmpty(params, "password")
	if password == "" {
		return nil, errors.New("password is required")
	}
	connection, err := s.requireConnectionConfig(params)
	if err != nil {
		return nil, err
	}
	if err := assertNotConnectedUser("create or modify", name, stringOrDefault(connection, "username", "guest")); err != nil {
		return nil, err
	}
	body := jsonObject{"password": password, "tags": userTagsParam(params)}
	if _, err := managementSend(connection, http.MethodPut, "/api/users/"+urlEncodePathSegment(name), body); err != nil {
		return nil, err
	}
	return okResult(), nil
}

func userTagsParam(params jsonObject) string {
	value, exists := params["tags"]
	if !exists || value == nil {

View on GitHub (pinned to c0390bff16)

Solutions

1. Provide a non-empty 'password' parameter in the createUser params.
2. If the password comes from an env var or secret store, verify the secret exists and is populated before calling.
3. If intending passwordless/credentials via another mechanism, use the hash-based parameter your tooling supports instead of an empty password.

Example fix

// before
params := jsonObject{"name": "svc-user", "tags": "monitoring"}
_, err := createUser(params) // error: password is required
// after
pwd := os.Getenv("RABBITMQ_PASSWORD")
if pwd == "" {
    return errors.New("RABBITMQ_PASSWORD must be set")
}
params := jsonObject{"name": "svc-user", "password": pwd, "tags": "monitoring"}
_, err := createUser(params)

pwd := os.Getenv("RABBITMQ_PASSWORD")
if pwd == "" {
    return errors.New("password must be provided before creating user")
}
createUser(jsonObject{"name": userName, "password": pwd})

func hasPassword(params map[string]any) bool {
    v, ok := params["password"]
    if !ok {
        return false
    }
    s, isStr := v.(string)
    return isStr && s != ""
}

When it happens

Trigger: Calling createUser (via dispatch) with 'name' set correctly but 'password' absent or set to "". Commonly combined with requireConnectionConfig and assertNotConnectedUser checks that run after this guard.

Common situations: Provisioning scripts where the password comes from a secrets manager or env var (e.g. RABBITMQ_PASSWORD) that is unset; secrets injection failures in CI/CD leaving the variable empty; template configs with a placeholder password field left blank; preferring secrets over plaintext and passing an empty secret by mistake.

Understand the failure class

Background: Missing required parameter errors: what 'X is required' and 'the required X param is missing' mean, and how to fix them — this error's family across 27 libraries.

Related errors

• topic (queue name) is required
• namespace is required
• name is required
• %s is required
• <label> are required

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/213181844a5b9458. Report an issue: GitHub.