apache/beam · error · RuntimeException

Problems while retrieving application default credentials.

Error message

Problems while retrieving application default credentials.

What it means

GoogleADCIdTokenProvider's constructor throws a RuntimeException wrapping the IOException from GoogleCredentials.getApplicationDefault() when Google Application Default Credentials cannot be located or read, or when the found credentials are not an IdTokenProvider (ClassCastException path aside, the documented failure is ADC retrieval). Constructing this provider therefore fails fast if the environment has no usable ADC.

Solutions

1. Set GOOGLE_APPLICATION_CREDENTIALS to a valid service-account JSON key
2. Run `gcloud auth application-default login` for local development
3. Ensure the code runs on GCP infrastructure with a metadata server, or provide explicit credentials
4. Verify the credential JSON is a service account that supports id tokens (not a user credential without IdTokenProvider support)

Example fix

// before: provider constructed eagerly, fails without ADC
GoogleADCIdTokenProvider provider = new GoogleADCIdTokenProvider();
// after: validate ADC availability first
try {
  GoogleCredentials creds = GoogleCredentials.getApplicationDefault();
  if (!(creds instanceof IdTokenProvider)) {
    throw new IllegalStateException("ADC does not support id tokens");
  }
  GoogleADCIdTokenProvider provider = new GoogleADCIdTokenProvider();
} catch (IOException e) { /* configure credentials */ }

try {
  GoogleCredentials creds = GoogleCredentials.getApplicationDefault();
  if (!(creds instanceof IdTokenProvider)) {
    throw new IllegalStateException("ADC lacks IdTokenProvider support");
  }
} catch (IOException e) {
  throw new IllegalStateException("Configure ADC first", e);
}

boolean adcAvailable() {
  try { return GoogleCredentials.getApplicationDefault() != null; }
  catch (IOException e) { return false; }
}

try {
  GoogleADCIdTokenProvider p = new GoogleADCIdTokenProvider();
} catch (RuntimeException e) {
  logger.error("ADC unavailable: set GOOGLE_APPLICATION_CREDENTIALS", e);
  throw e;
}

When it happens

Trigger: new GoogleADCIdTokenProvider() when ADC is absent (no GOOGLE_APPLICATION_CREDENTIALS, no gcloud user credentials, no metadata server) or unreadable, or when the resolved credential type does not implement IdTokenProvider.

Common situations: Running locally without `gcloud auth application-default login`; missing GOOGLE_APPLICATION_CREDENTIALS env var; service-account key lacking token-creation scope; deploying on infra without a GCE metadata server; key file path invalid.

Related errors

• Failed to get application default credential.
• GCP Authentication Extension not configured properly
• Unable to obtain credential
• API Key is required for writing events.
• Could not find file

AI-assisted analysis of apache/beam@12126d8942 (2026-09-13). Data as JSON: /api/errors/1bc344b74569975a. Report an issue: GitHub.

Appendix: source

Thrown at sdks/java/io/amazon-web-services2/src/main/java/org/apache/beam/sdk/io/aws2/auth/GoogleADCIdTokenProvider.java:52

 * resources use a similar configuration to:
 *
 * <pre>{@code --awsCredentialsProvider={
 *   "@type": "StsAssumeRoleForFederatedCredentialsProvider",
 *   "roleArn": "<the AWS ARN of the role to be assumed by the pipeline>",
 *   "audience": "<the configured Audience for the federated authentication>",
 *   "webIdTokenProviderFQCN": "org.apache.beam.sdk.io.aws2.auth.GoogleADCIdTokenProvider",
 *   "durationSeconds": 3600
 * }}</pre>
 */
@SuppressFBWarnings(value = "CT_CONSTRUCTOR_THROW", justification = "Initialization is safe.")
public class GoogleADCIdTokenProvider implements WebIdTokenProvider {
  private final IdTokenProvider idTokenProvider;

  public GoogleADCIdTokenProvider() {
    try {
      this.idTokenProvider = (IdTokenProvider) GoogleCredentials.getApplicationDefault();
    } catch (IOException ex) {
      throw new RuntimeException("Problems while retrieving application default credentials.", ex);
    }
  }

  @VisibleForTesting
  IdTokenCredentials createIdTokenWithApplicationDefaultCredentials(String audience) {
    return IdTokenCredentials.newBuilder()
        .setIdTokenProvider(this.idTokenProvider)
        .setTargetAudience(audience)
        .setOptions(Arrays.asList(Option.FORMAT_FULL, Option.LICENSES_TRUE))
        .build();
  }

  @Override
  public String resolveTokenValue(String audience) {
    try {
      return createIdTokenWithApplicationDefaultCredentials(audience)
          .refreshAccessToken()
          .getTokenValue();

View on GitHub (pinned to 12126d8942)