Skip to content

Troubleshooting: DB2i_USER and DB2i_PASS with Token Authentication #77

Description

@itsdevansh

The Problem

When setting up IBM i HTTP authentication with Bearer tokens, you might encounter this error:

❌ Invalid environment variables found: {
  DB2i_USER: [ 'DB2i_USER is required for IBM i connections.' ],
  DB2i_PASS: [ 'DB2i_PASS is required for IBM i connections.' ]
}

This can be confusing because you're using token-based authentication where credentials come from the Bearer token, not from the .env file.

Root Cause

This error occurs when DB2i_USER or DB2i_PASS are set to empty strings in your .env file:

# ❌ This causes the error - empty string values
DB2i_USER=
DB2i_PASS=

Why This Happens

The Zod validation schema uses .min(1).optional():

DB2i_USER: z.string().min(1, "DB2i_USER is required...").optional()
  • When the variable is undefined (not in .env at all): ✅ Passes - .optional() allows undefined
  • When the variable is an empty string (""): ❌ Fails - .min(1) rejects empty strings

The Solution

Simply don't include DB2i_USER and DB2i_PASS in your .env file when using token authentication.

✅ Correct .env for Token Auth

# IBM i Connection - Host only, NO credentials
DB2i_HOST=your-ibmi-host.example.com
DB2i_PORT=8076
DB2i_IGNORE_UNAUTHORIZED=true

# HTTP Transport
MCP_TRANSPORT_TYPE=http
MCP_HTTP_PORT=3010
MCP_HTTP_HOST=0.0.0.0

# IBM i Token Authentication
IBMI_HTTP_AUTH_ENABLED=true
MCP_AUTH_MODE=ibmi
IBMI_AUTH_ALLOW_HTTP=true
IBMI_AUTH_KEY_ID=production
IBMI_AUTH_PRIVATE_KEY_PATH=secrets/private.pem
IBMI_AUTH_PUBLIC_KEY_PATH=secrets/public.pem
IBMI_AUTH_TOKEN_EXPIRY_SECONDS=7200

# Tool Configuration
TOOLS_YAML_PATH=tools
MCP_LOG_LEVEL=info

❌ Incorrect Configurations

# Wrong: Empty values cause validation error
DB2i_USER=
DB2i_PASS=

# Wrong: Whitespace-only values also fail
DB2i_USER= 
DB2i_PASS= 

⚠️ Alternative: Placeholder Values (Works but unnecessary)

If you prefer to explicitly show these variables exist, you can use placeholder values:

DB2i_USER=TOKEN_AUTH
DB2i_PASS=TOKEN_AUTH

These placeholders will pass validation but are never used when token authentication is enabled - the server uses credentials from the Bearer token instead.

Metadata

Metadata

Assignees

Labels

documentationImprovements or additions to documentation

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions