apache/hadoop · warning · IOException

No console available for checking user.

Error message

No console available for checking user.

What it means

The 'hadoop credential check <alias>' command must read a password interactively to compare it against the stored credential; PasswordReader wraps System.console(), and when the JVM has no console (stdin piped/redirected, no TTY) it is null, so the command aborts before checking anything.

Source

Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/alias/CredentialShell.java:359

        }
      } catch (IOException e) {
        e.printStackTrace(getErr());
      }
      return true;
    }

    public void execute() throws IOException, NoSuchAlgorithmException {
      if (alias.equals("-help")) {
        doHelp();
        return;
      }
      warnIfTransientProvider();
      getOut().println("Checking aliases for CredentialProvider: " +
          provider.toString());
      try {
        PasswordReader c = getPasswordReader();
        if (c == null) {
          throw new IOException("No console available for checking user.");
        }

        char[] password = null;
        if (value != null) {
          // testing only
          password = value.toCharArray();
        } else {
          password = c.readPassword("Enter alias password: ");
        }
        CredentialEntry credentialEntry = provider.getCredentialEntry(alias);
        if(credentialEntry == null) {
          // Fail the password match when alias not found
          getOut().println("Password match failed for " + alias + ".");
        } else {
          char[] storePassword = credentialEntry.getCredential();
          String beMatch =
              Arrays.equals(storePassword, password) ? "success" : "failed";

View on GitHub (pinned to 2add963021)

Solutions

1. Run the command in a real interactive terminal (ssh -t for remote)
2. Use the non-interactive flag: hadoop credential check <alias> -value <secret> -provider <path> (value is compared instead of prompted)
3. For automation, drop the shell: read via the API provider.getCredentialEntry(alias) and compare in code

Example fix

# before (no TTY -> fails)
hadoop credential check my.alias -provider jceks://file/creds.jceks < /dev/null

# after (non-interactive value check)
hadoop credential check my.alias -value 's3cret' -provider jceks://file/creds.jceks

// Guard any wrapper around the shell: console or explicit value, never neither
if (System.console() == null && value == null) {
  throw new IllegalStateException(
      "'hadoop credential check' needs a TTY or an explicit -value argument");
}

try {
  runShell("credential", "check", alias, "-provider", providerUri);
} catch (IOException ex) {
  if (ex.getMessage().contains("No console available")) {
    // rerun with -value or allocate a TTY (ssh -t / docker exec -it)
  } else { throw ex; }
}

When it happens

Trigger: Running 'hadoop credential check <alias> -provider ...' from a pipe, script, cron, CI runner, ssh with no tty, or an IDE console - anywhere System.console() returns null.

Common situations: Automated verification pipelines calling the check command; Docker containers without -t; nohup/background runs.

Related errors

• No console available for prompting user.
• Path must be absolute: " + path
• Append is not supported by BaiduBosFileSystem
• No more entry in " + f
• f + " is a directory"

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/a7199bd0cb12098c. Report an issue: GitHub.