apache/hadoop · error · IOException

KeyProvider ${keyProvider} was found but it is a transient p

Error message

KeyProvider ${keyProvider} was found but it is a transient provider.

What it means

Even a successfully constructed provider is rejected when isTransient() is true: KMSUtil throws IOException("KeyProvider ... was found but it is a transient provider") because the calling features (encryption-zone keys, KMS delegation tokens) require a durable shared key store, not an in-memory one such as the 'user://' UserProvider.

Source

Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/util/KMSUtil.java:89

  public static URI getKeyProviderUri(final Configuration conf,
                                      final String configKeyName) {
    final String providerUriStr = conf.getTrimmed(configKeyName);
    // No provider set in conf
    if (providerUriStr == null || providerUriStr.isEmpty()) {
      return null;
    }
    return URI.create(providerUriStr);
  }

  public static KeyProvider createKeyProviderFromUri(final Configuration conf,
      final URI providerUri) throws IOException {
    KeyProvider keyProvider = KeyProviderFactory.get(providerUri, conf);
    if (keyProvider == null) {
      throw new IOException("Could not instantiate KeyProvider for uri: " +
          providerUri);
    }
    if (keyProvider.isTransient()) {
      throw new IOException("KeyProvider " + keyProvider.toString()
          + " was found but it is a transient provider.");
    }
    return keyProvider;
  }

  @SuppressWarnings("unchecked")
  public static Map toJSON(KeyProvider.KeyVersion keyVersion) {
    Map json = new HashMap();
    if (keyVersion != null) {
      json.put(KMSRESTConstants.NAME_FIELD,
          keyVersion.getName());
      json.put(KMSRESTConstants.VERSION_NAME_FIELD,
          keyVersion.getVersionName());
      json.put(KMSRESTConstants.MATERIAL_FIELD,
          Base64.encodeBase64URLSafeString(
              keyVersion.getMaterial()));
    }
    return json;

View on GitHub (pinned to 2add963021)

Solutions

1. Set hadoop.security.key.provider.path to a durable provider URI, e.g. kms://https@kms-host:9600/kms, in core-site.
2. Restart the service or CLI so the provider is rebuilt from the corrected configuration.
3. Check which provider the factory actually selected (the exception names it) and remove the competing user:// entry.

URI uri = URI.create(conf.getTrimmed("hadoop.security.key.provider.path"));
if ("user".equalsIgnoreCase(uri.getScheme())) {
  throw new IllegalStateException(
      "user:// provider is transient; configure kms://https@host:9600/kms");
}

When it happens

Trigger: hadoop.security.key.provider.path set to user:// (or resolving to the in-memory UserProvider) while the code path needs a durable provider - for example creating encryption zones or requesting delegation tokens.

Common situations: core-site stripped down for local tests so the KMS URI is gone; a fallback default of user:// taking effect; provider resolution order selecting UserProvider ahead of the configured KMS provider.

Related errors

• Could not instantiate KeyProvider for uri: ${providerUri}
• Class-name comparators are not enabled (set tfile.comparator
• No configuration found for the cipher suite {} prefixed with
• No KeyProvider is configured, cannot access an encrypted fil
• Errors on getting mount table loader class. The fs.viewfs.mo

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/0c1de033845e6e71. Report an issue: GitHub.