apache/hadoop · error · InvalidCredentialsException

Credentials should not be null.

Error message

Credentials should not be null.

What it means

Thrown by AliyunCredentialsProvider.setCredentials() when it is called with a null Credentials object. This class implements the Aliyun OSS SDK's CredentialsProvider interface and guards its setter against null so the provider never holds undefined credentials. It is a programming-error guard, not a configuration error: the SDK's ClientConfiguration or client code passed null explicitly.

Source

Thrown at hadoop-tools/hadoop-aliyun/src/main/java/org/apache/hadoop/fs/aliyun/oss/AliyunCredentialsProvider.java:72

    if (StringUtils.isEmpty(accessKeyId)
        || StringUtils.isEmpty(accessKeySecret)) {
      throw new InvalidCredentialsException(
          "AccessKeyId and AccessKeySecret should not be null or empty.");
    }

    if (StringUtils.isNotEmpty(securityToken)) {
      credentials = new DefaultCredentials(accessKeyId, accessKeySecret,
          securityToken);
    } else {
      credentials = new DefaultCredentials(accessKeyId, accessKeySecret);
    }
  }

  @Override
  public void setCredentials(Credentials creds) {
    if (creds == null) {
      throw new InvalidCredentialsException("Credentials should not be null.");
    }

    credentials = creds;
  }

  @Override
  public Credentials getCredentials() {
    if (credentials == null) {
      throw new InvalidCredentialsException("Invalid credentials");
    }

    return credentials;
  }
}

View on GitHub (pinned to 2add963021)

Solutions

1. Construct a com.aliyun.oss.common.auth.DefaultCredentials(accessKeyId, accessKeySecret) (or with securityToken for STS) and pass that instance instead of null
2. If refreshing STS tokens, check the token-fetch result for null/empty before calling setCredentials and fail the refresh with a clear error instead
3. Prefer letting the provider build credentials itself from fs.oss.accessKeyId / fs.oss.accessKeySecret / fs.oss.securityToken configuration rather than setting them externally

Example fix

// before
provider.setCredentials(fetchStsCredentials()); // returns null on failure

// after
Credentials c = fetchStsCredentials();
if (c == null || StringUtils.isBlank(c.getAccessKeyId())) {
  throw new IOException("STS credential refresh returned no credentials");
}
provider.setCredentials(c);

// before calling setCredentials
if (creds == null) {
  throw new IllegalArgumentException("creds must be built from a successful token fetch");
}
provider.setCredentials(creds);

catch (InvalidCredentialsException e) { /* treat as unrecoverable setup bug; fail fast with context */ throw new IllegalStateException("Credential provider misuse", e); }

When it happens

Trigger: Calling AliyunCredentialsProvider.setCredentials(null) directly, or wiring this provider into com.aliyun.oss.OSSClientBuilder code that initializes providers with a null Credentials instance before real keys are loaded.

Common situations: Custom tooling that refreshes STS session credentials and calls setCredentials with the result of a failed token fetch (null); test code constructing providers without DefaultCredentials; migration from an older OSS SDK whose provider chain tolerated null.

Related errors

• Invalid credentials
• Stream closed.
• Failed to multipart upload to oss, abort it.
• Multi-part upload with id '{uploadId}' to {key}
• Append is not supported!

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/8da8747ca3dac4a3. Report an issue: GitHub.