apache/hadoop · error · IOException

No KeyProvider is configured, cannot access an encrypted fil

Error message

No KeyProvider is configured, cannot access an encrypted file

What it means

To decrypt a file's EDEK (encrypted data-encryption key), HdfsKMSUtil.decryptEncryptedDataEncryptionKey requires a KeyProvider; if the client has none configured, it throws this IOException before attempting decryption. The KeyProvider normally comes from dfs.encryption.key.provider.uri / hadoop.security.key.provider.path resolving to the cluster's KMS. Any read of an encryption-zone file needs it, even just to open the stream.

Source

Thrown at hadoop-hdfs-project/hadoop-hdfs-client/src/main/java/org/apache/hadoop/hdfs/HdfsKMSUtil.java:207

      Configuration conf) throws IOException {
    // File is encrypted, wrap the stream in a crypto stream.
    // Currently only one version, so no special logic based on the version#
    HdfsKMSUtil.getCryptoProtocolVersion(fileEncryptionInfo);
    final CryptoCodec codec = HdfsKMSUtil.getCryptoCodec(
        conf, fileEncryptionInfo);
    final KeyVersion decrypted =
        decryptEncryptedDataEncryptionKey(fileEncryptionInfo, keyProvider);
    return new CryptoInputStream(is, codec, decrypted.getMaterial(),
        fileEncryptionInfo.getIV());
  }

  /**
   * Decrypts a EDEK by consulting the KeyProvider.
   */
  static KeyVersion decryptEncryptedDataEncryptionKey(FileEncryptionInfo
      feInfo, KeyProvider keyProvider) throws IOException {
    if (keyProvider == null) {
      throw new IOException("No KeyProvider is configured, cannot access" +
          " an encrypted file");
    }
    EncryptedKeyVersion ekv = EncryptedKeyVersion.createForDecryption(
        feInfo.getKeyName(), feInfo.getEzKeyVersionName(), feInfo.getIV(),
        feInfo.getEncryptedDataEncryptionKey());
    try {
      KeyProviderCryptoExtension cryptoProvider = KeyProviderCryptoExtension
          .createKeyProviderCryptoExtension(keyProvider);
      return cryptoProvider.decryptEncryptedKey(ekv);
    } catch (GeneralSecurityException e) {
      throw new IOException(e);
    }
  }
}

View on GitHub (pinned to 2add963021)

Solutions

1. Set dfs.encryption.key.provider.uri (e.g. kms://https@kms-host:9600/kms) in the client's core-site.xml or Configuration
2. Load the cluster's core-site.xml/hdfs-site.xml on the client (conf.addResource) instead of an empty Configuration
3. Confirm the KMS is running and reachable on that URI, and that TLS/SSL client config allows the connection
4. For keyserver-less setups, configure a fallback provider via hadoop.security.key.provider.path.uri

Example fix

// before
Configuration conf = new Configuration(); // no key provider -> IOException on EZ read

// after
Configuration conf = new Configuration();
conf.set("dfs.encryption.key.provider.uri", "kms://https@kms-host:9600/kms");

// Before opening files that may live in an EZ, ensure a key provider is set:
String provider = conf.get("dfs.encryption.key.provider.uri",
    conf.get("hadoop.security.key.provider.path.uri"));
if (provider == null) {
  throw new IllegalStateException(
      "Configure dfs.encryption.key.provider.uri (KMS) before reading encrypted data");
}

try {
  in = fs.open(encryptedPath);
} catch (IOException e) {
  if (e.getMessage().contains("No KeyProvider is configured")) {
    throw new IllegalStateException("Missing KMS config: set dfs.encryption.key.provider.uri", e);
  }
  throw e;
}

When it happens

Trigger: Opening/reading a file inside an HDFS encryption zone from a client whose Configuration has no dfs.encryption.key.provider.uri (and no hadoop.security.key.provider.path.uri fallback): raw new Configuration() in app code, edge nodes without KMS config, or the KMS URI scheme typo'd so provider creation was skipped.

Common situations: Custom Java/Spark/Hive clients assembled without the cluster's core-site.xml (which carries dfs.encryption.key.provider.uri=kms://https@HOST:9600/kms); moving jobs to new edge nodes that were never provisioned with KMS TLS config; credential-provider setups where the KMS URI lives in a JCEKS not loaded by the client.

Related errors

• "Can't create an encryption zone for " + src + " since no ke
• No configuration found for the cipher suite {} prefixed with
• Could not instantiate KeyProvider for uri: ${providerUri}
• KeyProvider ${keyProvider} was found but it is a transient p
• Client does not support specified CryptoProtocolVersion {} v

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/aec22ccc31939c8c. Report an issue: GitHub.