apache/hadoop · critical · IllegalStateException

No KeyProvider has been defined

Error message

No KeyProvider has been defined

What it means

During KMS webapp initialization (KMSWebApp servlet-context listener), KMS reads hadoop.kms.key.provider.uri (KMSConfiguration.KEY_PROVIDER_URI) from kms-site.xml. If the property is absent it throws IllegalStateException 'No KeyProvider has been defined' and the webapp fails to deploy: the KMS has no backing keystore (KeyProvider) to read/write keys and refuses to start. A distinct follow-on check (Preconditions.checkNotNull) covers the case where the URI is set but no factory can handle its scheme.

Source

Thrown at hadoop-common-project/hadoop-kms/src/main/java/org/apache/hadoop/crypto/key/kms/server/KMSWebApp.java:129

      reencryptEEKCallsMeter = metricRegistry.register(REENCRYPT_EEK_METER,
          new Meter());
      reencryptEEKBatchCallsMeter = metricRegistry.register(
          REENCRYPT_EEK_BATCH_METER, new Meter());
      adminCallsMeter = metricRegistry.register(ADMIN_CALLS_METER, new Meter());
      keyCallsMeter = metricRegistry.register(KEY_CALLS_METER, new Meter());
      invalidCallsMeter = metricRegistry.register(INVALID_CALLS_METER,
          new Meter());
      unauthorizedCallsMeter = metricRegistry.register(UNAUTHORIZED_CALLS_METER,
          new Meter());
      unauthenticatedCallsMeter = metricRegistry.register(
          UNAUTHENTICATED_CALLS_METER, new Meter());

      kmsAudit = new KMSAudit(kmsConf);

      // initializing the KeyProvider
      String providerString = kmsConf.get(KMSConfiguration.KEY_PROVIDER_URI);
      if (providerString == null) {
        throw new IllegalStateException("No KeyProvider has been defined");
      }
      KeyProvider keyProvider =
          KeyProviderFactory.get(new URI(providerString), kmsConf);
      Preconditions.checkNotNull(keyProvider, String.format("No" +
              " KeyProvider has been initialized, please" +
              " check whether %s '%s' is configured correctly in" +
              " kms-site.xml.", KMSConfiguration.KEY_PROVIDER_URI,
          providerString));
      if (kmsConf.getBoolean(KMSConfiguration.KEY_CACHE_ENABLE,
          KMSConfiguration.KEY_CACHE_ENABLE_DEFAULT)) {
        long keyTimeOutMillis =
            kmsConf.getLong(KMSConfiguration.KEY_CACHE_TIMEOUT_KEY,
                KMSConfiguration.KEY_CACHE_TIMEOUT_DEFAULT);
        long currKeyTimeOutMillis =
            kmsConf.getLong(KMSConfiguration.CURR_KEY_CACHE_TIMEOUT_KEY,
                KMSConfiguration.CURR_KEY_CACHE_TIMEOUT_DEFAULT);
        keyProvider = new CachingKeyProvider(keyProvider, keyTimeOutMillis,
            currKeyTimeOutMillis);

View on GitHub (pinned to 2add963021)

Solutions

1. Add hadoop.kms.key.provider.uri to kms-site.xml, e.g. kms://file@/var/lib/hadoop-kms/keystore (file-backed) or kms://https@kms-host:9600/kms (chained)
2. Make sure kms.config.dir actually contains the edited kms-site.xml so it is loaded
3. If the URI is set but you still see the follow-on Preconditions error, check the URI scheme matches a registered KeyProviderFactory (file, kms, jceks, javakeystore)

Example fix

<!-- kms-site.xml -->
<property>
  <name>hadoop.kms.key.provider.uri</name>
  <value>kms://file@/var/lib/hadoop-kms/keystore</value>
</property>

Configuration conf = KMSConfiguration.getConfiguration(false, "kms-site.xml");
if (conf.get(KMSConfiguration.KEY_PROVIDER_URI) == null)
  throw new IllegalStateException("kms-site.xml must define hadoop.kms.key.provider.uri");

When it happens

Trigger: Fresh KMS install where kms-site.xml lacks hadoop.kms.key.provider.uri; config file not being loaded because kms.config.dir points at an empty directory; the property name misspelled. Typical valid value: kms://file@/path/keystore or kms://https@host:port/kms (a KMS backed by another KMS).

Common situations: New deployments forgetting the keystore URI;分层 deployments where the local KMS should delegate to a remote KMS; config-dir mistakes after moving from /etc/hadoop-kms/conf to a custom path; test setups that copy kms-default.xml only.

Related errors

• Failed to load %s, please check configuration hadoop.kms.aud
• Failed to initialize %s
• System property 'kms.config.dir' must be an absolute path: %
• System property 'kms.config.dir' not defined
• System property 'log4j.configuration' not defined

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/db883af6bb00e722. Report an issue: GitHub.