apache/hadoop · critical · InvalidCredentialsException

Invalid credentials

Error message

Invalid credentials

What it means

Thrown by AliyunCredentialsProvider.getCredentials() when the internal credentials field is still null. In practice the constructor already builds credentials from fs.oss.accessKeyId/fs.oss.accessKeySecret (and throws InvalidCredentialsException itself if they are missing), so reaching getCredentials() with a null field means the provider was constructed without configuration or the field was never set after a failed refresh.

Source

Thrown at hadoop-tools/hadoop-aliyun/src/main/java/org/apache/hadoop/fs/aliyun/oss/AliyunCredentialsProvider.java:81

          securityToken);
    } else {
      credentials = new DefaultCredentials(accessKeyId, accessKeySecret);
    }
  }

  @Override
  public void setCredentials(Credentials creds) {
    if (creds == null) {
      throw new InvalidCredentialsException("Credentials should not be null.");
    }

    credentials = creds;
  }

  @Override
  public Credentials getCredentials() {
    if (credentials == null) {
      throw new InvalidCredentialsException("Invalid credentials");
    }

    return credentials;
  }
}

View on GitHub (pinned to 2add963021)

Solutions

1. Set fs.oss.accessKeyId and fs.oss.accessKeySecret (and optionally fs.oss.securityToken) in core-site.xml or the Configuration passed to the provider so the constructor populates credentials
2. If using the provider standalone, call setCredentials(new DefaultCredentials(id, secret)) before the first getCredentials()
3. For temporary credentials, configure fs.oss.credentials.provider with an STS-aware provider class instead of relying on manual set/get

Example fix

// before
AliyunCredentialsProvider p = new AliyunCredentialsProvider(conf);
Credentials c = p.getCredentials(); // InvalidCredentialsException

// after
conf.set("fs.oss.accessKeyId", id);
conf.set("fs.oss.accessKeySecret", secret);
Credentials c = new AliyunCredentialsProvider(conf).getCredentials();

String id = conf.get("fs.oss.accessKeyId");
String secret = conf.get("fs.oss.accessKeySecret");
if (StringUtils.isAnyBlank(id, secret)) {
  throw new IOException("fs.oss.accessKeyId/accessKeySecret not configured");
}
new AliyunCredentialsProvider(conf).getCredentials();

catch (InvalidCredentialsException e) { // config problem, not transient: report missing keys and fail job setup throw e; }

When it happens

Trigger: Instantiating AliyunCredentialsProvider in a way that bypasses the configuration path and never calling setCredentials; calling getCredentials() before any credentials were established; a refresh flow that nulled the field before the getter ran.

Common situations: Unit tests that new the provider with an empty Configuration path; SDK versions where provider instantiation is lazy and getCredentials is invoked during the first OSS request; embedding the provider in custom OSS client code that assumes a default credential chain exists (it does not in this class).

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Credentials should not be null.
• Stream closed.
• Failed to multipart upload to oss, abort it.
• Multi-part upload with id '{uploadId}' to {key}
• Append is not supported!

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/d198dfc19cd846ff. Report an issue: GitHub.