apache/hadoop · error · IOException

Bad configuration of hadoop.security.credential.provider.pat

Error message

Bad configuration of hadoop.security.credential.provider.path at {}

What it means

Each entry of hadoop.security.credential.provider.path is parsed with new URI(path); a URISyntaxException is wrapped as this IOException. The entry is not a syntactically valid URI - typically unencoded spaces or special characters, an embedded Windows drive path, or stray characters - so no provider was even consulted.

Source

Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/alias/CredentialProviderFactory.java:107

            }
            for (CredentialProviderFactory factory : serviceLoader) {
              CredentialProvider kp = factory.createProvider(uri, conf);
              if (kp != null) {
                result.add(kp);
                found = true;
                break;
              }
            }
          } finally {
            SERVICE_LOADER_LOCKED.set(false);
          }
        }
        if (!found) {
          throw new IOException("No CredentialProviderFactory for " + uri + " in " +
              CREDENTIAL_PROVIDER_PATH);
        }
      } catch (URISyntaxException error) {
        throw new IOException("Bad configuration of " + CREDENTIAL_PROVIDER_PATH +
            " at " + path, error);
      }
    }
    return result;
  }
}

View on GitHub (pinned to 2add963021)

Solutions

Percent-encode unsafe characters: space as %20 (jceks://file/home/u/my%20creds.jceks)
On Windows use the file:/// authority form: jceks://file/C:/creds.jceks only if it parses; otherwise localjceks://file/C:/creds.jceks
Rename the keystore file to a scheme-safe name without spaces/specials - simplest fix
Validate every entry with new URI(entry) in a scratch program or jshell before pushing config

Example fix

# before
jceks://file/home/hadoop/my creds.jceks   # URISyntaxException

# after
jceks://file/home/hadoop/my%20creds.jceks

Defensive patterns

Strategy: validation

Validate before calling

// Reject syntactically invalid entries before Hadoop hits URISyntaxException
static void validateUris(Configuration conf) throws IOException {
  for (String entry : conf.getStringCollection("hadoop.security.credential.provider.path")) {
    try {
      new java.net.URI(entry);
    } catch (java.net.URISyntaxException e) {
      throw new IOException("Invalid provider path entry '" + entry + "': " + e.getReason(), e);
    }
  }
}

Try / catch

try {
  providers = CredentialProviderFactory.getProviders(conf);
} catch (IOException ex) {
  if (ex.getMessage() != null && ex.getMessage().contains("Bad configuration of")) {
    // an entry failed URI parsing: find spaces/specials, percent-encode or rename the file
  } else { throw ex; }
}

Prevention

Avoid spaces and non-ASCII characters in keystore file names
URI-encode paths you cannot rename (space -> %20)
Quote XML property values and avoid smart quotes when pasting paths into config files

When it happens

Trigger: Paths containing spaces ('jceks://file/C:/Program Files/creds.jceks'), non-ASCII or reserved characters (%, #, ?), Windows paths like 'jceks://file/C:/creds.jceks' (colon in authority position), or trailing garbage after copy-paste.

Common situations: Windows installs; keystore file names with spaces; locales producing smart quotes in XML config; shell quoting that injects characters into the env var.

Related errors

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/d9335cd3a10ec099. Report an issue: GitHub.