apache/hadoop · error · IOException

Password {key} not found

Error message

Password {key} not found

What it means

Thrown by AdlFileSystem.getPasswordString, a thin wrapper over Configuration.getPassword(String) that returns the secret as a String for Azure Data Lake (adl://) OAuth2 setup. getPassword resolves the key from configuration XML and transparently from Hadoop Credential Providers, so this IOException means the key exists nowhere: not in core-site.xml, not set programmatically, and no matching alias in the configured credential store. The exact offending key name is included in the message.

Source

Thrown at hadoop-tools/hadoop-azure-datalake/src/main/java/org/apache/hadoop/fs/adl/AdlFileSystem.java:969

          "No value for " + key + " found in conf file.");
    }
    return value;
  }

  /**
   * A wrapper of {@link Configuration#getPassword(String)}. It returns
   * <code>String</code> instead of <code>char[]</code>.
   *
   * @param conf the configuration
   * @param key the property key
   * @return the password string
   * @throws IOException if the password was not found
   */
  private static String getPasswordString(Configuration conf, String key)
      throws IOException {
    char[] passchars = conf.getPassword(key);
    if (passchars == null) {
      throw new IOException("Password " + key + " not found");
    }
    return new String(passchars);
  }

  @VisibleForTesting
  public void setUserGroupRepresentationAsUPN(boolean enableUPN) {
    oidOrUpn = enableUPN ? UserGroupRepresentation.UPN :
        UserGroupRepresentation.OID;
  }

  /**
   * Gets ADL account name from ADL FQDN.
   * @param accountFQDN ADL account fqdn
   * @return ADL account name
   */
  public static String getAccountNameFromFQDN(String accountFQDN) {
    return accountFQDN.contains(".")
            ? accountFQDN.substring(0, accountFQDN.indexOf("."))

View on GitHub (pinned to 2add963021)

Solutions

1. Set the missing key (the message names it) in core-site.xml or via conf.set/conf.setPassword before the filesystem is initialized
2. If using a credential provider, create the alias: hadoop credential create dfs.adls.oauth2.credential -provider jceks:///path/store.jceks, and set hadoop.security.credential.provider.path to that URI
3. Verify the alias resolves: hadoop credential list -provider jceks:///path/store.jceks
4. Double-check spelling of the dfs.adls.oauth2.* keys against AdlConfKeys for your Hadoop version

Example fix

// before: core-site.xml has no dfs.adls.oauth2.credential
// -> IOException: Password dfs.adls.oauth2.credential not found

// after (in XML)
<property>
  <name>dfs.adls.oauth2.credential</name>
  <value>...</value>
</property>

// after (secret kept out of XML)
<property>
  <name>hadoop.security.credential.provider.path</name>
  <value>jceks:///etc/security/adl.jceks</value>
</property>

import org.apache.hadoop.conf.Configuration;
import java.io.IOException;

static void requireAdlSecrets(Configuration conf) throws IOException {
  String[] keys = {
      "dfs.adls.oauth2.client.id",
      "dfs.adls.oauth2.refresh.url",
      "dfs.adls.oauth2.credential" };
  for (String key : keys) {
    if (conf.getPassword(key) == null) {
      throw new IOException("Missing required secret '" + key
          + "': set it in core-site.xml or provision it via "
          + "hadoop credential create " + key + " -provider jceks://...");
    }
  }
}
// call before any AdlFileSystem operation

Wrap filesystem acquisition (FileSystem.get(adlUri, conf)) in try/catch IOException; when the message starts with 'Password ' and ends with ' not found', report the named key and abort startup with a provisioning hint instead of retrying.

When it happens

Trigger: Initializing an adl:// FileSystem when one of the ADL OAuth2 keys (dfs.adls.oauth2.client.id, dfs.adls.oauth2.credential, dfs.adls.oauth2.refresh.url, dfs.adls.oauth2.refresh.token, per AdlConfKeys) resolves to null. The provider path at AdlFileSystem.java:303-312 calls getPasswordString for client-id/refresh-url/client-secret (client-credential flow) or client-id/refresh-token (refresh-token flow).

Common situations: Cluster migrated and the ADL secrets were never re-provisioned; a typo in the dfs.adls.oauth2.* property name so getPassword returns null; the secret lives in a jceks store but hadoop.security.credential.provider.path is missing or points at the wrong URI; tests running with a stripped-down Configuration.

Related errors

• Cannot find password option {key}
• No COS Credential Providers
• Cannot find password option {}
• Recursive load of credential provider; if loading a JCEKS fi
• No CredentialProviderFactory for {} in hadoop.security.crede

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/bb567cb600d5abd2. Report an issue: GitHub.