apache/hadoop · error · IOException

No CredentialProviderFactory for {} in hadoop.security.crede

Error message

No CredentialProviderFactory for {} in hadoop.security.credential.provider.path

What it means

For each entry in hadoop.security.credential.provider.path, getProviders() asks every ServiceLoader-registered CredentialProviderFactory to claim the URI; if none does (found stays false), this IOException is thrown. It means the URI's scheme matches no provider implementation on the classpath - usually a typo'd scheme, a missing scheme, or the jar implementing the scheme is absent.

Source

Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/alias/CredentialProviderFactory.java:103

              throw new PathIOException(path,
                  "Recursive load of credential provider; " +
                      "if loading a JCEKS file, this means that the filesystem connector is " +
                      "trying to load the same file");
            }
            for (CredentialProviderFactory factory : serviceLoader) {
              CredentialProvider kp = factory.createProvider(uri, conf);
              if (kp != null) {
                result.add(kp);
                found = true;
                break;
              }
            }
          } finally {
            SERVICE_LOADER_LOCKED.set(false);
          }
        }
        if (!found) {
          throw new IOException("No CredentialProviderFactory for " + uri + " in " +
              CREDENTIAL_PROVIDER_PATH);
        }
      } catch (URISyntaxException error) {
        throw new IOException("Bad configuration of " + CREDENTIAL_PROVIDER_PATH +
            " at " + path, error);
      }
    }
    return result;
  }
}

View on GitHub (pinned to 2add963021)

Solutions

Use a shipped scheme with exact spelling: jceks://HDFS-authority/path, jceks://file/path, localjceks://file/path, user://
For a bare filesystem path, add the scheme prefix: jceks://file/home/u/creds.jceks
If you need an extra scheme (kms://, cloud stores), add the implementing jar and check its META-INF/services/org.apache.hadoop.security.alias.CredentialProviderFactory entry
Print conf.getStringCollection("hadoop.security.credential.provider.path") and eyeball every entry before debugging deeper

Example fix

# before
export HADOOP_CREDENTIAL_PROVIDER_PATH=/home/hadoop/creds.jceks   # no scheme -> no factory claims it

# after
export HADOOP_CREDENTIAL_PROVIDER_PATH=jceks://file/home/hadoop/creds.jceks

Defensive patterns

Strategy: validation

Validate before calling

// Validate every provider-path entry before calling getProviders()
static final Set<String> KNOWN_SCHEMES = Set.of("jceks", "localjceks", "user");

static void validateProviderPath(Configuration conf) throws IOException {
  for (String entry : conf.getStringCollection("hadoop.security.credential.provider.path")) {
    String scheme = URI.create(entry).getScheme();
    if (scheme == null || !KNOWN_SCHEMES.contains(scheme)) {
      throw new IOException("Unknown/missing provider scheme in entry: " + entry);
    }
  }
}

Type guard

boolean isSupportedProviderUri(String entry) {
  String scheme = URI.create(entry).getScheme();
  return scheme != null
      && ("jceks".equals(scheme) || "localjceks".equals(scheme) || "user".equals(scheme));
}

Try / catch

try {
  providers = CredentialProviderFactory.getProviders(conf);
} catch (IOException ex) {
  if (ex.getMessage() != null && ex.getMessage().startsWith("No CredentialProviderFactory")) {
    // parse the URI out of the message, fix the scheme (typo or missing), re-run
  } else { throw ex; }
}

Prevention

Lint hadoop.security.credential.provider.path in config CI: every entry must have a known scheme
Remember shipped schemes: jceks://, localjceks://, user:// - and add extra jars for anything else
When adding a new provider jar, verify its META-INF/services registration survived shading

When it happens

Trigger: Path entry with a typo'd scheme (jcekss://, jcks://); entry with no scheme at all ('/home/u/creds.jceks' parses as URI with null scheme); scheme provided by a jar not on the classpath (e.g. KMS-backed or third-party providers); META-INF/services registration missing in a shaded/relocated jar.

Common situations: Copy-paste typos in core-site.xml / HADOOP_CREDENTIAL_PROVIDER_PATH; assuming 'hadoop credential' supports a scheme that only exists with extra jars; upgrading Hadoop where provider SPI registration moved.

Related errors

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/fa314b99eff9e4fa. Report an issue: GitHub.