apache/beam · error · IOException

Azure credential provider type '%s' is not supported

Error message

Azure credential provider type '%s' is not supported

What it means

After reading the type name, deserializeWithType only supports DefaultAzureCredential, ClientSecretCredential, ClientCertificateCredential, UsernamePasswordCredential and (per the visible branch) shared-token variants; anything else throws IOException "Azure credential provider type '%s' is not supported". The module has a fixed allowlist of credential classes it can reconstruct.

Source

Thrown at sdks/java/io/azure/src/main/java/org/apache/beam/sdk/io/azure/options/AzureModule.java:148

              .build();
        } else {
          return new ClientCertificateCredentialBuilder()
              .clientId(asMap.getOrDefault(AZURE_CLIENT_ID, ""))
              .pfxCertificate(
                  asMap.getOrDefault(AZURE_PFX_CERTIFICATE_PATH, ""),
                  asMap.getOrDefault(AZURE_PFX_CERTIFICATE_PASSWORD, ""))
              .tenantId(asMap.getOrDefault(AZURE_TENANT_ID, ""))
              .build();
        }
      } else if (typeName.equals(UsernamePasswordCredential.class.getSimpleName())) {
        return new UsernamePasswordCredentialBuilder()
            .clientId(asMap.getOrDefault(AZURE_CLIENT_ID, ""))
            .username(asMap.getOrDefault(AZURE_USERNAME, ""))
            .password(asMap.getOrDefault(AZURE_PASSWORD, ""))
            .tenantId(asMap.getOrDefault(AZURE_TENANT_ID, ""))
            .build();
      } else {
        throw new IOException(
            String.format("Azure credential provider type '%s' is not supported", typeName));
      }
    }
  }

  private static class TokenCredentialSerializer extends JsonSerializer<TokenCredential> {
    @Override
    public void serialize(
        TokenCredential tokenCredential,
        JsonGenerator jsonGenerator,
        SerializerProvider serializers)
        throws IOException {
      serializers.defaultSerializeValue(tokenCredential, jsonGenerator);
    }

    @SuppressWarnings("nullness")
    private static Object getMember(Object obj, String member)
        throws IllegalAccessException, NoSuchFieldException {

View on GitHub (pinned to 12126d8942)

Solutions

1. Use a supported credential type such as DefaultAzureCredential or ClientSecretCredential.
2. Prefer DefaultAzureCredential, which resolves managed identity/CLI/environment credentials at runtime and serializes as a supported name.
3. Upgrade the Beam Azure SDK module if a newer version added support for your credential type.
4. Check the exact simple class name in the JSON matches what the deserializer expects (case-sensitive).

Example fix

// before
options.setCredential(new AzureCliCredentialBuilder().build()); // not supported on deserialize
// after
options.setCredential(new DefaultAzureCredentialBuilder().build());

java.util.Set<String> supported = java.util.Set.of("DefaultAzureCredential", "ClientSecretCredential",
    "ClientCertificateCredential", "UsernamePasswordCredential");
if (!supported.contains(typeName)) {
  throw new IllegalArgumentException("credential type not deserializable: " + typeName);
}

try {
  return deserialize(json);
} catch (IOException e) {
  if (e.getMessage().contains("not supported")) {
    throw new IllegalStateException("swap to DefaultAzureCredential/ClientSecretCredential", e);
  }
  throw e;
}

When it happens

Trigger: Deserializing a payload whose type name is an unsupported TokenCredential subclass (e.g. ManagedIdentityCredential, AzureCliCredential, InteractiveBrowserCredential), or a typo'd/renamed type string.

Common situations: Serializing with one Azure SDK identity version and deserializing where the allowlist differs; hand-writing type names like "EnvironmentCredential" that the deserializer does not handle; custom TokenCredential implementations.

Related errors

• Failed to serialize and deserialize property '%s' with value
• Unsupported underlying type for producing LogicalType via co
• Failed to convert PipelineOptions to Protocol
• Failed to serialize %s value: %s
• Azure credentials provider could not be read.

AI-assisted analysis of apache/beam@12126d8942 (2026-09-13). Data as JSON: /api/errors/218df3e5e5c05aeb. Report an issue: GitHub.