apache/hadoop · error · IOException

Cannot find password option {key}

Error message

Cannot find password option {key}

What it means

IOException thrown by S3AUtils.lookupPassword when Configuration.getPassword(key) itself fails with an IOException. getPassword normally returns null for absent values; an exception means Hadoop could not read the configured credential source - most commonly a hadoop.security.credential.provider.path pointing at a missing, unreadable, or corrupt JCEKS keystore.

Source

Thrown at hadoop-tools/hadoop-aws/src/main/java/org/apache/hadoop/fs/s3a/S3AUtils.java:911

  }

  /**
   * Get a password from a configuration/configured credential providers.
   * @param conf configuration
   * @param key key to look up
   * @param defVal value to return if there is no password
   * @return a password or the value in {@code defVal}
   * @throws IOException on any problem
   */
  static String lookupPassword(Configuration conf, String key, String defVal)
      throws IOException {
    try {
      final char[] pass = conf.getPassword(key);
      return pass != null ?
          new String(pass).trim()
          : defVal;
    } catch (IOException ioe) {
      throw new IOException("Cannot find password option " + key, ioe);
    }
  }

  /**
   * String information about a summary entry for debug messages.
   * @param s3Object s3Object entry
   * @return string value
   */
  public static String stringify(S3Object s3Object) {
    StringBuilder builder = new StringBuilder(s3Object.key().length() + 100);
    builder.append("\"").append(s3Object.key()).append("\" ");
    builder.append("size=").append(s3Object.size());
    return builder.toString();
  }

  /**
   * Get a integer option >= the minimum allowed value.
   * @param conf configuration

View on GitHub (pinned to 2add963021)

Solutions

1. Verify the hadoop.security.credential.provider.path entry exists and is readable by the runtime user: hadoop credential list -provider jceks://file:///path/s3.jceks
2. Fix the URL scheme/typos and confirm the keystore file is deployed on every node that opens the S3A filesystem
3. Check keystore file permissions and supply the keystore password if the store is protected
4. Temporarily put the secret in core-site.xml to isolate provider problems from S3 connectivity, then move it back to the keystore

Example fix

<!-- before: provider path with a missing/mistyped store URL -->
<property><name>hadoop.security.credential.provider.path</name>
  <value>jceks://file/opt/hadoop/conf/s3.jceks</value></property>

<!-- after: correct file:// URL to an existing, readable keystore -->
<property><name>hadoop.security.credential.provider.path</name>
  <value>jceks://file:///opt/hadoop/conf/s3.jceks</value></property>

String providers = conf.get("hadoop.security.credential.provider.path", "");
for (String p : providers.split(",")) {
  if (p.startsWith("jceks://file:") || p.startsWith("localjceks://file:")) {
    String file = p.substring(p.indexOf("file:"));
    if (!new java.io.File(file).canRead()) {
      throw new IOException("Credential store unreadable: " + p);
    }
  }
}

catch IOException whose message starts with 'Cannot find password option' during fs initialization; report the named key and the credential provider path - it is a setup problem, never retryable

When it happens

Trigger: Resolving a password-type S3A option (fs.s3a.access.key, fs.s3a.secret.key, fs.s3a.encryption.key, etc.) through a Hadoop CredentialProvider whose store cannot be opened: jceks:// or localjceks:// URL missing, wrong keystore password, corrupt file, or unreachable HDFS path.

Common situations: Deploying configs that reference a keystore not shipped to every node; typo'd credential.provider.path or missing file:// scheme; keystore file permissions; migrating configs between clusters; custom keystore password not supplied to processes.

Related errors

• SSE-C is enabled but no encryption key was declared in fs.s3
• SimpleAWSCredentialsProvider: No AWS credentials in the Hado
• Unset property fs.s3a.assumed.role.arn
• Class {className} AWS provider class cannot be used (configu
• Cannot find password option {}

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/9d69653bc9a84a46. Report an issue: GitHub.