apache/hadoop · warning · IOException

No console available for prompting user.

Error message

No console available for prompting user.

What it means

'hadoop credential create <alias>' prompts twice for the new secret via promptForCredential(); the prompt needs a System.console(). When stdin/stdout are not a console (script, cron, CI, piped input), getPasswordReader() returns null and create aborts with this IOException before writing anything.

Source

Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/alias/CredentialShell.java:476

            e.getMessage());
        throw e;
      } catch (IOException e) {
        getOut().println("Credential " + alias + " has NOT been created. " +
            e.getMessage());
        throw e;
      }
    }

    @Override
    public String getUsage() {
      return USAGE + ":\n\n" + DESC;
    }
  }

  protected char[] promptForCredential() throws IOException {
    PasswordReader c = getPasswordReader();
    if (c == null) {
      throw new IOException("No console available for prompting user.");
    }

    char[] cred = null;

    boolean noMatch;
    do {
      char[] newPassword1 = c.readPassword("Enter alias password: ");
      char[] newPassword2 = c.readPassword("Enter alias password again: ");
      noMatch = !Arrays.equals(newPassword1, newPassword2);
      if (noMatch) {
        if (newPassword1 != null) {
          Arrays.fill(newPassword1, ' ');
        }
        c.format("Passwords don't match. Try again.%n");
      } else {
        cred = newPassword1;
      }
      if (newPassword2 != null) {

View on GitHub (pinned to 2add963021)

Solutions

1. Pass the secret explicitly: hadoop credential create <alias> -value <secret> -provider <path> (value flag bypasses prompting)
2. Or run the command with a TTY allocated (ssh -t, docker exec -it, expect)
3. For full control in automation, use the Java API: provider.createCredentialEntry(alias, value.toCharArray()) + provider.flush()

Example fix

# before (no console -> fails)
hadoop credential create fs.s3a.secret.key -provider jceks://file/creds.jceks < /dev/null

# after (non-interactive)
hadoop credential create fs.s3a.secret.key -value 's3cret' -provider jceks://file/creds.jceks

// Fail fast before launching the shell from a non-interactive context
if (System.console() == null) {
  cmd.add("-value"); cmd.add(secret);   // non-interactive path for 'credential create'
} else {
  // interactive double-prompt is fine
}

try {
  runShell("credential", "create", alias, "-provider", providerUri);
} catch (IOException ex) {
  if (ex.getMessage().contains("No console available")) {
    // rerun with -value <secret>, or use the API: createCredentialEntry + flush
  } else { throw ex; }
}

When it happens

Trigger: Running 'hadoop credential create <alias> -provider ...' non-interactively: cron jobs, CI pipelines, docker exec without -t, input redirected from /dev/null, orchestration tools (Ansible/Puppet) shelling out.

Common situations: Automated cluster provisioning that bootstraps credential stores; container images running hadoop credential; documentation tested interactively then wired into scripts.

Related errors

• No console available for checking user.
• Path must be absolute: " + path
• Append is not supported by BaiduBosFileSystem
• No more entry in " + f
• f + " is a directory"

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/ffb7fc06bf246872. Report an issue: GitHub.