apache/hadoop · error · IOException

Can't get credential " + alias + " from " + getPathAsString(

Error message

Can't get credential " + alias + " from " + getPathAsString()

What it means

AbstractJavaKeyStoreProvider.getCredentialEntry looks an alias up in a Java KeyStore; a KeyStoreException from getKey() - keystore not initialized/loaded, or internally inconsistent - is wrapped in this IOException naming the alias and the keystore path. (Distinct from the sibling catches: NoSuchAlgorithmException and UnrecoverableKeyException produce different messages.)

Source

Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/alias/AbstractJavaKeyStoreProvider.java:185

    path = ProviderUtils.unnestUri(keystoreUri);
    if (LOG.isDebugEnabled()) {
      LOG.debug("backing jks path initialized to " + path);
    }
  }

  @Override
  public CredentialEntry getCredentialEntry(String alias)
      throws IOException {
    readLock.lock();
    try {
      SecretKeySpec key = null;
      try {
        if (!keyStore.containsAlias(alias)) {
          return null;
        }
        key = (SecretKeySpec) keyStore.getKey(alias, password);
      } catch (KeyStoreException e) {
        throw new IOException("Can't get credential " + alias + " from "
            + getPathAsString(), e);
      } catch (NoSuchAlgorithmException e) {
        throw new IOException("Can't get algorithm for credential " + alias
            + " from " + getPathAsString(), e);
      } catch (UnrecoverableKeyException e) {
        throw new IOException("Can't recover credential " + alias + " from "
            + getPathAsString(), e);
      }
      return new CredentialEntry(alias, bytesToChars(key.getEncoded()));
    } finally {
      readLock.unlock();
    }
  }

  public static char[] bytesToChars(byte[] bytes) throws IOException {
    String pass;
    pass = new String(bytes, StandardCharsets.UTF_8);
    return pass.toCharArray();

View on GitHub (pinned to 2add963021)

Solutions

  1. Validate the store from CLI: `hadoop credential list -provider jceks://file/path/to/store.jceks`
  2. Verify the provider path in config resolves to an existing, readable, non-empty file with correct owner/permissions
  3. If the file is corrupt, recreate it and re-add secrets: `hadoop credential create <alias> -provider ...`
  4. Confirm the keystore password source (hadoop.security.credential.clear-text-fallback / provider password file or env) matches how the store was created

Example fix

# before: provider path points at a truncated store
# after: recreate and verify the store
hadoop credential create my.secret -provider jceks://file/etc/hadoop/store.jceks
hadoop credential list -provider jceks://file/etc/hadoop/store.jceks
Defensive patterns

Strategy: try-catch

Validate before calling

org.apache.hadoop.conf.Configuration conf = new org.apache.hadoop.conf.Configuration();
String provider = "jceks://file/etc/hadoop/creds.jceks";
java.nio.file.Path p = java.nio.file.Paths.get(
    provider.substring(provider.indexOf("://file/") + 7));
if (!java.nio.file.Files.exists(p) || java.nio.file.Files.size(p) == 0) {
  throw new IllegalStateException("credential store missing or empty: " + p);
}

Try / catch

try {
  CredentialEntry ce = provider.getCredentialEntry(alias);
} catch (IOException e) {
  if (e.getMessage() != null && e.getMessage().contains("Can't get credential")) {
    // keystore-level failure (not a missing alias, which returns null)
    LOG.error("credential store unusable for alias {}", alias, e);
  }
  throw e;
}

Prevention

When it happens

Trigger: keyStore.getKey(alias, password) throwing KeyStoreException: the underlying JCEKS/JavaKeyStore was never loaded successfully - file missing, zero bytes, truncated by a failed write, or wrong keystore format - while containsAlias(alias) returned true or the store is in a half-open state.

Common situations: Credential store file corrupted or truncated (concurrent creation, disk full, kill during write); hadoop.security.credential.provider.path pointing to a missing file; a JCEKS file replaced with a PKCS12 (or vice versa); partial permissions preventing read of an existing store.

Related errors

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/230cf15fdb8adf6d. Report an issue: GitHub.