testcontainers/testcontainers-java · error · IllegalStateException

Conflicting Elasticsearch credentials: provide either a…

Error message

Conflicting Elasticsearch credentials: provide either a service account token or a username/password pair, not both.

What it means

KibanaContainer allows exactly one Elasticsearch authentication method: either a service account token or a username/password pair. withKibanaUsernameAndPassword throws IllegalStateException if a service account token was already set via withElasticsearchServiceAccountToken, preventing mutually exclusive credentials from being written into Kibana's environment.

Solutions

Remove the withElasticsearchServiceAccountToken(...) call if you intend username/password auth.
Or remove withKibanaUsernameAndPassword(...) and keep token-based auth.
Ensure only one credential mechanism is configured per KibanaContainer.

Example fix

// before
.withElasticsearchServiceAccountToken(token)
.withKibanaUsernameAndPassword("kibana", "pass"); // throws
// after
.withElasticsearchServiceAccountToken(token);

Defensive patterns

Strategy: validation

Validate before calling

if (serviceToken != null && (username != null || password != null)) throw new IllegalStateException("Configure either service account token or username/password, not both");

Prevention

Decide the auth mechanism per test suite before configuring containers.
Remove token configuration when switching to basic auth and vice versa.
Use one helper method for Kibana credential setup.

When it happens

Trigger: Calling withKibanaUsernameAndPassword(...) after withElasticsearchServiceAccountToken(...) has been called on the same container.

Common situations: Merging configuration helpers where one sets token auth and another sets basic auth; incremental migration from basic auth to service account tokens without removing the old call.

Understand the failure class

Background: Conflicting config options: "cannot be used together" — configuration validation errors across open-source libraries — this error's family across 162 libraries.

Related errors

AI-assisted analysis of testcontainers/testcontainers-java@8e549514e3 (2026-09-12). Data as JSON: /api/errors/8713214ba435629a. Report an issue: GitHub.

Appendix: source

Thrown at modules/elasticsearch/src/main/java/org/testcontainers/elasticsearch/KibanaContainer.java:200

     * @param password the password for the kibana_system user
     * @return this container instance
     */
    public KibanaContainer withKibanaSystemPassword(String password) {
        return withKibanaUsernameAndPassword(KIBANA_SYSTEM_USER, password);
    }

    /**
     * Configures credentials Kibana will use for authentication.
     *
     * @param username the Elasticsearch username (cannot be 'elastic')
     * @param password the password
     * @return this container instance
     * @throws IllegalStateException if a service account token is already configured
     * @throws IllegalArgumentException if credentials are invalid
     */
    public KibanaContainer withKibanaUsernameAndPassword(String username, String password) {
        if (elasticsearchServiceAccountToken != null) {
            throw new IllegalStateException(
                "Conflicting Elasticsearch credentials: provide either a service account token " +
                "or a username/password pair, not both."
            );
        }
        if (StringUtils.isAnyBlank(username, password)) {
            throw new IllegalArgumentException("Kibana credentials cannot be blank");
        }
        if (!username.equals(username.trim()) || !password.equals(password.trim())) {
            throw new IllegalArgumentException("Kibana credentials cannot have leading or trailing whitespace");
        }
        if ("elastic".equals(username)) {
            throw new IllegalArgumentException("Username 'elastic' is reserved for internal use by Elasticsearch");
        }

        this.elasticsearchUsername = username;
        this.elasticsearchPassword = password;
        return this;
    }

View on GitHub (pinned to 8e549514e3)