apache/iceberg · error · IllegalArgumentException

Cannot initialize AdlsTokenCredentialProvider, %s does not i

Error message

Cannot initialize AdlsTokenCredentialProvider, %s does not implement AdlsTokenCredentialProvider.

What it means

After reflectively constructing an instance from the configured class name, loadCredentialProvider casts it to AdlsTokenCredentialProvider. If the class was instantiated but does not actually implement that interface, the ClassCastException is converted into this IllegalArgumentException.

Source

Thrown at azure/src/main/java/org/apache/iceberg/azure/AdlsTokenCredentialProviders.java:75

    try {
      ctor =
          DynConstructors.builder(AdlsTokenCredentialProvider.class)
              .loader(AdlsTokenCredentialProviders.class.getClassLoader())
              .hiddenImpl(impl)
              .buildChecked();
    } catch (NoSuchMethodException e) {
      throw new IllegalArgumentException(
          String.format(
              "Cannot initialize AdlsTokenCredentialProvider, missing no-arg constructor: %s",
              impl),
          e);
    }

    AdlsTokenCredentialProvider provider;
    try {
      provider = ctor.newInstance();
    } catch (ClassCastException e) {
      throw new IllegalArgumentException(
          String.format(
              "Cannot initialize AdlsTokenCredentialProvider, %s does not implement AdlsTokenCredentialProvider.",
              impl),
          e);
    }

    provider.initialize(properties);
    return provider;
  }

  static class DefaultTokenCredentialProvider implements AdlsTokenCredentialProvider {

    @Override
    public TokenCredential credential() {
      return new DefaultAzureCredentialBuilder().build();
    }

    @Override

View on GitHub (pinned to 86d9c8fc54)

Solutions

Make the configured class implement org.apache.iceberg.azure.AdlsTokenCredentialProvider.
Check the configured class name; replace it with a class that implements the interface.
If the old implementation was removed or renamed, update the configuration to the new class name.

Example fix

// before
public class MyProvider { public String token() { ... } }
// after
public class MyProvider implements AdlsTokenCredentialProvider {
  @Override public Credential getOAuth2Token() { ... }
}

Defensive patterns

Strategy: type-guard

Validate before calling

Class<?> cls = Class.forName(implClassName);
if (!AdlsTokenCredentialProvider.class.isAssignableFrom(cls)) throw new IllegalArgumentException(implClassName + " does not implement AdlsTokenCredentialProvider");

Type guard

boolean isProvider = obj instanceof AdlsTokenCredentialProvider;

Try / catch

try { provider = AdlsTokenCredentialProviders.from(config); } catch (IllegalArgumentException e) { log.error("Configured class does not implement AdlsTokenCredentialProvider: {}", config.get("impl")); throw e; }

Prevention

Have custom provider classes implement AdlsTokenCredentialProvider and verify with a compile-time check (e.g. an abstract base class).
Double-check the fully-qualified class name in configuration.
Add a smoke test that instantiates the configured provider at startup.

When it happens

Trigger: Configuring the ADLS credential provider class name with a class that exists and has a no-arg constructor but does not implement org.apache.iceberg.azure.AdlsTokenCredentialProvider.

Common situations: Copy-pasting a class name from another provider mechanism (e.g. a Hadoop CredentialProvider or generic auth class); renaming/refactoring an implementation away from the interface while the config still points at it.

Understand the failure class

Background: Type mismatch errors: IllegalArgumentException, TypeError and type guards across 150 open-source libraries — this error's family across 150 libraries.

Related errors

AI-assisted analysis of apache/iceberg@86d9c8fc54 (2026-09-12). Data as JSON: /api/errors/5fe363b6ddb6f7dd. Report an issue: GitHub.