apache/hadoop · critical · InvalidUriException

Invalid URI %s - account name is not fully qualified.

Error message

Invalid URI %s - account name is not fully qualified.

What it means

With fs.azure.account.auth.type=SharedKey, the store derives the storage account name from the URI authority by taking the substring before the first '.', and signs requests with it. If the authority's account part contains no dot (e.g. abfs://container@myaccount with no domain suffix), SharedKeyCredentials cannot be built and initialization throws InvalidUriException 'account name is not fully qualified'.

Source

Thrown at hadoop-tools/hadoop-azure/src/main/java/org/apache/hadoop/fs/azurebfs/AzureBlobFileSystemStore.java:1852

    try {
      baseUrl = new URL(url);
    } catch (MalformedURLException e) {
      throw new InvalidUriException(uri.toString());
    }

    SharedKeyCredentials creds = null;
    AccessTokenProvider tokenProvider = null;
    SASTokenProvider sasTokenProvider = null;

    if (authType == AuthType.OAuth) {
      AzureADAuthenticator.init(abfsConfiguration);
    }

    if (authType == AuthType.SharedKey) {
      LOG.trace("Fetching SharedKey credentials");
      int dotIndex = accountName.indexOf(AbfsHttpConstants.DOT);
      if (dotIndex <= 0) {
        throw new InvalidUriException(
                uri.toString() + " - account name is not fully qualified.");
      }
      creds = new SharedKeyCredentials(accountName.substring(0, dotIndex),
            abfsConfiguration.getStorageAccountKey());
    } else if (authType == AuthType.SAS) {
      LOG.trace("Fetching SAS Token Provider");
      sasTokenProvider = abfsConfiguration.getSASTokenProvider();
    } else if (authType == AuthType.UserboundSASWithOAuth) {
      LOG.trace("Fetching SAS and OAuth Token Provider for user bound SAS");
      AzureADAuthenticator.init(abfsConfiguration);
      Object[] providers
          = abfsConfiguration.getUserBoundSASBothTokenProviders();
      tokenProvider = (AccessTokenProvider) providers[0];
      sasTokenProvider = (SASTokenProvider) providers[1];
      ExtensionHelper.bind(tokenProvider, uri,
          abfsConfiguration.getRawConfiguration());
    } else {
      LOG.trace("Fetching token provider");

View on GitHub (pinned to 2add963021)

Solutions

1. Use the fully qualified account in fs.defaultFS: abfs://container@account.dfs.core.windows.net.
2. Name the key property to match exactly: fs.azure.account.key.account.dfs.core.windows.net=<base64 key>.
3. For Azurite keep the fully qualified devstoreaccount1.dfs.core.windows.net authority and point fs.azure.abfs.endpoint at 127.0.0.1.
4. If short names are mandatory, use OAuth or SAS auth instead - SharedKey requires the domain.

Example fix

<!-- before -->
<property><name>fs.defaultFS</name><value>abfs://c@myaccount</value></property>
<property><name>fs.azure.account.auth.type</name><value>SharedKey</value></property>

<!-- after -->
<property><name>fs.defaultFS</name><value>abfs://c@myaccount.dfs.core.windows.net</value></property>
<property><name>fs.azure.account.auth.type</name><value>SharedKey</value></property>
<property><name>fs.azure.account.key.myaccount.dfs.core.windows.net</name><value>BASE64KEY</value></property>

String authority = new URI(fsDefaultFS).getAuthority(); // container@account...
String account = authority.substring(authority.indexOf('@') + 1);
if ("SharedKey".equals(conf.get("fs.azure.account.auth.type")) && !account.contains(".")) {
  throw new IllegalArgumentException("SharedKey requires fully qualified account name, got: " + account);
}

try { fs = FileSystem.get(conf); } catch (InvalidUriException e) { if (e.getMessage().contains("not fully qualified")) { /* add domain suffix to account in fs.defaultFS */ } throw e; }

When it happens

Trigger: Auth type SharedKey plus a fs.defaultFS authority whose account segment lacks a domain suffix; also account-specific key properties (fs.azure.account.key.<authority>) whose name does not echo the fully-qualified account, so no key resolves.

Common situations: Switching a mount from OAuth/SAS (which tolerate short names) to SharedKey; Azurite-style configs carried into real cloud; truncated account names in templated core-site.xml.

Related errors

• "%s" must be set for user-bound SAS auth type.
• ABFS endpoint is not set correctly : %s, Do not specify sche
• Invalid URI %s
• Both global key and encryption context are set, only one all
• Encoded SHA256 hash must be provided for global encryption

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/6e7e0b6e6b042758. Report an issue: GitHub.