apache/hadoop · error · IllegalArgumentException

Proxy error: fs.oss.proxy.username or fs.oss.proxy.password

Error message

Proxy error: fs.oss.proxy.username or fs.oss.proxy.password set without the other.

What it means

Thrown by AliyunOSSFileSystemStore.initialize() during proxy setup: exactly one of fs.oss.proxy.username / fs.oss.proxy.password is configured (null vs non-null check), which cannot form a valid proxy credential pair. The store throws IllegalArgumentException with a message naming the missing counterpart key.

Source

Thrown at hadoop-tools/hadoop-aliyun/src/main/java/org/apache/hadoop/fs/aliyun/oss/AliyunOSSFileSystemStore.java:148

      clientConf.setProxyHost(proxyHost);
      if (proxyPort >= 0) {
        clientConf.setProxyPort(proxyPort);
      } else {
        if (secureConnections) {
          LOG.warn("Proxy host set without port. Using HTTPS default 443");
          clientConf.setProxyPort(443);
        } else {
          LOG.warn("Proxy host set without port. Using HTTP default 80");
          clientConf.setProxyPort(80);
        }
      }
      String proxyUsername = conf.getTrimmed(PROXY_USERNAME_KEY);
      String proxyPassword = conf.getTrimmed(PROXY_PASSWORD_KEY);
      if ((proxyUsername == null) != (proxyPassword == null)) {
        String msg = "Proxy error: " + PROXY_USERNAME_KEY + " or " +
            PROXY_PASSWORD_KEY + " set without the other.";
        LOG.error(msg);
        throw new IllegalArgumentException(msg);
      }
      clientConf.setProxyUsername(proxyUsername);
      clientConf.setProxyPassword(proxyPassword);
      clientConf.setProxyDomain(conf.getTrimmed(PROXY_DOMAIN_KEY));
      clientConf.setProxyWorkstation(conf.getTrimmed(PROXY_WORKSTATION_KEY));
    } else if (proxyPort >= 0) {
      String msg = "Proxy error: " + PROXY_PORT_KEY + " set without " +
          PROXY_HOST_KEY;
      LOG.error(msg);
      throw new IllegalArgumentException(msg);
    }

    String endPoint = conf.getTrimmed(ENDPOINT_KEY, "");
    if (StringUtils.isEmpty(endPoint)) {
      throw new IllegalArgumentException("Aliyun OSS endpoint should not be " +
          "null or empty. Please set proper endpoint with 'fs.oss.endpoint'.");
    }
    CredentialsProvider provider =

View on GitHub (pinned to 2add963021)

Solutions

1. Set both fs.oss.proxy.username and fs.oss.proxy.password (or remove both if the proxy needs no auth)
2. If secrets come from a credential store, verify both entries resolve: hadoop credential list and the alias names match exactly
3. Check for typos/case errors in the property names so neither key is silently dropped

Example fix

<!-- before -->
<property><name>fs.oss.proxy.host</name><value>proxy.corp</value></property>
<property><name>fs.oss.proxy.username</name><value>alice</value></property>

<!-- after -->
<property><name>fs.oss.proxy.host</name><value>proxy.corp</value></property>
<property><name>fs.oss.proxy.username</name><value>alice</value></property>
<property><name>fs.oss.proxy.password</name><value>${proxy.secret}</value></property>

String u = conf.getTrimmed("fs.oss.proxy.username");
String p = conf.getTrimmed("fs.oss.proxy.password");
if ((u == null) != (p == null)) {
  throw new IOException("Configure both fs.oss.proxy.username and fs.oss.proxy.password, or neither");
}

catch (IllegalArgumentException e) { /* init-time config bug: fix the proxy property pair; do not retry */ throw e; }

When it happens

Trigger: Setting fs.oss.proxy.username in core-site.xml without fs.oss.proxy.password (or vice versa) while fs.oss.proxy.host is configured; templated configs where the secret injection failed silently; typos in one of the two property names so only the other takes effect.

Common situations: Secrets managed via credential providers/JCEKS where only one property resolves; cluster-level proxy settings partially overridden by job config; environments behind authenticated proxies migrating from no-auth proxy config.

Related errors

• SignVersion is V4 but region is empty
• Credentials should not be null.
• Invalid credentials
• Stream closed.
• Failed to multipart upload to oss, abort it.

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/9afd6b29437b2d4b. Report an issue: GitHub.