apache/hadoop · error · IOException

Bad configuration of hadoop.security.key.provider.path at ${

Error message

Bad configuration of hadoop.security.key.provider.path at ${path}

What it means

An entry in hadoop.security.key.provider.path could not be parsed by new URI(path) - a URISyntaxException - so the provider chain cannot even be constructed; the wrapping IOException names both the property and the offending value. Causes are literal syntax problems in the URI, not missing providers.

Source

Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/KeyProviderFactory.java:76

      iterServices.next();
    }
  }
  
  public static List<KeyProvider> getProviders(Configuration conf
                                               ) throws IOException {
    List<KeyProvider> result = new ArrayList<KeyProvider>();
    for(String path: conf.getStringCollection(KEY_PROVIDER_PATH)) {
      try {
        URI uri = new URI(path);
        KeyProvider kp = get(uri, conf);
        if (kp != null) {
          result.add(kp);
        } else {
          throw new IOException("No KeyProviderFactory for " + uri + " in " +
              KEY_PROVIDER_PATH);
        }
      } catch (URISyntaxException error) {
        throw new IOException("Bad configuration of " + KEY_PROVIDER_PATH +
            " at " + path, error);
      }
    }
    return result;
  }

  /**
   * Create a KeyProvider based on a provided URI.
   *
   * @param uri key provider URI
   * @param conf configuration to initialize the key provider
   * @return the key provider for the specified URI, or <code>NULL</code> if
   *         a provider for the specified URI scheme could not be found.
   * @throws IOException thrown if the provider failed to initialize.
   */
  public static KeyProvider get(URI uri, Configuration conf)
      throws IOException {
    KeyProvider kp = null;

View on GitHub (pinned to 2add963021)

Solutions

1. URL-encode illegal characters in the URI (space -> %20, '[' ']' -> %5B %5D)
2. Remove stray quotes, whitespace and separators introduced during config editing
3. Validate each entry up front with new URI(value) or `hadoop key list -provider <value>`

Example fix

<!-- before -->
<value>jceks://file/my keys/keystore.jceks</value>

<!-- after -->
<value>jceks://file/my%20keys/keystore.jceks</value>

for (String entry : conf.getStringCollection("hadoop.security.key.provider.path")) {
  try { new URI(entry); } // preflight parse
  catch (URISyntaxException e) {
    throw new IllegalArgumentException("bad provider path entry '" + entry + "': " + e.getMessage(), e);
  }
}

try { KeyProviderFactory.getProviders(conf); } catch (IOException e) { if (e.getCause() instanceof URISyntaxException) { // fix/encode the offending entry from the message, then reload config } else { throw e; } }

When it happens

Trigger: Unencoded spaces or illegal characters in file paths (space must be %20); stray quotes, semicolons or whitespace introduced while editing core-site.xml; malformed scheme parts like '://host' with no scheme.

Common situations: Windows or human-friendly paths pasted into provider config unencoded; XML property values copied from docs with smart quotes; shell variable interpolation leaving junk characters.

Related errors

• Wrong key length. Required ${options.getBitLength()}, but go
• Wrong key length. Required ${meta.getBitLength()}, but got $
• attributes cannot have a NULL key
• Can't find KeyProvider for key ${keyName}
• No KeyProviderFactory for ${uri} in ${KEY_PROVIDER_PATH}

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/e1b8de98ae66364b. Report an issue: GitHub.