apache/hadoop · critical · NoAuthWithCOSException

No COS Credentials provided by %s

Error message

No COS Credentials provided by %s

What it means

getCredentials() walks the provider chain and accepts the first provider whose credentials have a non-empty access key AND secret key, or which returns AnonymousCOSCredentials. If every provider yields null or blank/incomplete credentials, it throws NoAuthWithCOSException("No COS Credentials provided by " + providers) — the chain is non-empty (unlike the empty-list error) but no provider could produce usable credentials.

Source

Thrown at hadoop-cloud-storage-project/hadoop-cos/src/main/java/org/apache/hadoop/fs/cosn/auth/COSCredentialsProviderList.java:112

    this.checkNotEmpty();

    if (this.reuseLastProvider && this.lastProvider != null) {
      return this.lastProvider.getCredentials();
    }

    for (COSCredentialsProvider provider : this.providers) {
      COSCredentials credentials = provider.getCredentials();
      if (null != credentials
           && !StringUtils.isNullOrEmpty(credentials.getCOSAccessKeyId())
           && !StringUtils.isNullOrEmpty(credentials.getCOSSecretKey())
           || credentials instanceof AnonymousCOSCredentials) {
        this.lastProvider = provider;
        return credentials;
      }
    }

    throw new NoAuthWithCOSException(
        "No COS Credentials provided by " + this.providers.toString());
  }

  @Override
  public void refresh() {
    if (this.closed()) {
      return;
    }

    for (COSCredentialsProvider cosCredentialsProvider : this.providers) {
      cosCredentialsProvider.refresh();
    }
  }

  @Override
  public void close() throws Exception {
    if (this.closed()) {
      return;

View on GitHub (pinned to 2add963021)

Solutions

  1. Inspect the providers list printed in the message to see which chain was actually built, then fix the specific provider's inputs
  2. For SimpleCosCredentialsProvider, verify fs.cosn.userinfo.secretId and fs.cosn.userinfo.secretKey are non-empty and valid
  3. For EnvironmentVariableCredentialsProvider, export COS_SECRETID and COS_SECRETKEY on all nodes
  4. Test credentials independently with the cos_api SDK or coscmd CLI from the same host

Example fix

# before
# fs.cosn.userinfo.secretId set, secretKey left empty
# -> No COS Credentials provided by [SimpleCosCredentialsProvider{...}]

# after
<property><name>fs.cosn.userinfo.secretId</name><value>AKIDxxxx</value></property>
<property><name>fs.cosn.userinfo.secretKey</name><value>xxxx</value></property>
Defensive patterns

Strategy: validation

Validate before calling

// Pre-flight the credential chain resolves non-blank credentials
String sid = conf.get("fs.cosn.userinfo.secretId");
String skey = conf.get("fs.cosn.userinfo.secretKey");
if (isNullOrEmpty(sid) || isNullOrEmpty(skey)) {
  throw new IllegalStateException("cosn secretId/secretKey missing or blank");
}

Try / catch

try {
  providerList.getCredentials();
} catch (NoAuthWithCOSException e) {
  // message lists every provider in the chain — use it to find which one is misconfigured
  LOG.error("Credential chain exhausted: {}", e.getMessage());
  throw e;
}

Prevention

When it happens

Trigger: SimpleCosCredentialsProvider configured but fs.cosn.userinfo.secretId/secretKey blank or placeholder; EnvironmentVariableCredentialsProvider with COS_SECRETID/COS_SECRETKEY unset or empty; a temporary-credentials provider whose underlying role/token fetch fails silently and returns null.

Common situations: Deploying to nodes without the env vars the provider expects; templates injecting empty secret values; rotating keys and leaving the config half-updated; running outside CVM while relying only on a role-based provider.

Related errors

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/e5c2c1cb13cf844f. Report an issue: GitHub.