apache/hadoop · error · KeyProviderException

Unable to get key from credential provider for account {acco

Error message

Unable to get key from credential provider for account {accountName}

What it means

Error "Unable to get key from credential provider for account {accountName}" thrown in apache/hadoop.

Source

Thrown at hadoop-tools/hadoop-azure/src/main/java/org/apache/hadoop/fs/azurebfs/services/ShellDecryptionKeyProvider.java:48

import org.slf4j.LoggerFactory;

/**
 * Shell decryption key provider which invokes an external script that will
 * perform the key decryption.
 */
public class ShellDecryptionKeyProvider extends SimpleKeyProvider {
  private static final Logger LOG = LoggerFactory.getLogger(ShellDecryptionKeyProvider.class);

  @Override
  public String getStorageAccountKey(String accountName, Configuration rawConfig)
      throws KeyProviderException {
    String envelope = super.getStorageAccountKey(accountName, rawConfig);

    AbfsConfiguration abfsConfig;
    try {
      abfsConfig = new AbfsConfiguration(rawConfig, accountName);
    } catch(IllegalAccessException | IOException e) {
      throw new KeyProviderException("Unable to get key from credential provider for account " + accountName, e);
    }

    final String command = abfsConfig.get(ConfigurationKeys.AZURE_KEY_ACCOUNT_SHELLKEYPROVIDER_SCRIPT);
    if (command == null) {
      throw new KeyProviderException(
          "Script path is not specified via fs.azure.shellkeyprovider.script");
    }

    String[] cmd = command.split(" ");
    String[] cmdWithEnvelope = Arrays.copyOf(cmd, cmd.length + 1);
    cmdWithEnvelope[cmdWithEnvelope.length - 1] = envelope;

    String decryptedKey = null;
    try {
      decryptedKey = Shell.execCommand(cmdWithEnvelope);
    } catch (IOException ex) {
      throw new KeyProviderException(ex);
    }

View on GitHub (pinned to 2add963021)

Solutions

1. Verify the shell key provider script path and that it outputs the key for the account on stdout.
2. Check script permissions and that it runs as the executing user.

When it happens

Trigger: The shell decryption key provider script fails to return an account key.

Common situations: See trigger scenarios.

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/ae29b0b0866832c9. Report an issue: GitHub.