apache/hadoop · error · IOException

Credential " + alias + " already exists in " + this

Error message

Credential " + alias + " already exists in " + this

What it means

createCredentialEntry() refuses to overwrite: the keystore already contains an entry with this exact alias. This is by design so secrets are not silently clobbered; to change a value you must delete the entry first, then create it again.

Source

Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/alias/AbstractJavaKeyStoreProvider.java:234

          list.add(alias);
        }
      } catch (KeyStoreException e) {
        throw new IOException("Can't get alias " + alias + " from "
            + getPathAsString(), e);
      }
      return list;
    } finally {
      readLock.unlock();
    }
  }

  @Override
  public CredentialEntry createCredentialEntry(String alias, char[] credential)
      throws IOException {
    writeLock.lock();
    try {
      if (keyStore.containsAlias(alias)) {
        throw new IOException("Credential " + alias + " already exists in "
            + this);
      }
      return innerSetCredential(alias, credential);
    } catch (KeyStoreException e) {
      throw new IOException("Problem looking up credential " + alias + " in "
          + this, e);
    } finally {
      writeLock.unlock();
    }
  }

  @Override
  public void deleteCredentialEntry(String name) throws IOException {
    writeLock.lock();
    try {
      try {
        if (keyStore.containsAlias(name)) {
          keyStore.deleteEntry(name);

View on GitHub (pinned to 2add963021)

Solutions

1. Delete the existing entry first: hadoop credential delete <alias> -provider <path> (or provider.deleteCredentialEntry(alias)), then create
2. Check before writing: provider.getCredentialEntry(alias) != null or 'hadoop credential list -provider <path>'
3. Make provisioning scripts idempotent: list aliases, delete-if-present, then create

Example fix

// before
provider.createCredentialEntry(alias, newPassword); // IOException: already exists

// after
if (provider.getCredentialEntry(alias) != null) {
  provider.deleteCredentialEntry(alias);
  provider.flush();
}
provider.createCredentialEntry(alias, newPassword);
provider.flush();

// Check-before-create (read is cheap and non-mutating)
if (provider.getCredentialEntry(alias) != null) {
  provider.deleteCredentialEntry(alias);
  provider.flush();
}
provider.createCredentialEntry(alias, material);
provider.flush();

boolean aliasMissing(CredentialProvider p, String alias) throws IOException {
  return p.getCredentialEntry(alias) == null;
}

try {
  provider.createCredentialEntry(alias, material);
} catch (IOException ex) {
  if (ex.getMessage() != null && ex.getMessage().contains("already exists")) {
    provider.deleteCredentialEntry(alias);
    provider.flush();
    provider.createCredentialEntry(alias, material); // deliberate overwrite
    provider.flush();
  } else { throw ex; }
}

When it happens

Trigger: Calling provider.createCredentialEntry(alias, material) when keyStore.containsAlias(alias) is true; running 'hadoop credential create <alias> -provider ...' a second time; provisioning scripts that run create on every deploy.

Common situations: Re-running bootstrap scripts that assume create is an upsert; rotating a password by re-creating the alias without deleting it first; two admins writing the same alias name.

Related errors

• Can't get credential " + alias + " from " + getPathAsString(
• Can't get algorithm for credential " + alias + " from " + ge
• Can't recover credential " + alias + " from " + getPathAsStr
• Can't get alias " + alias + " from " + getPathAsString()
• Problem looking up credential " + alias + " in " + this

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/bc21e9d30031fea9. Report an issue: GitHub.