{"record":{"id":"0099052cdbd870aa","repo":"apache/hadoop","slug":"credential-name-does-not-exist-in-this","errorCode":null,"errorMessage":"Credential \" + name + \" does not exist in \" + this","messagePattern":"Credential \" \\+ name \\+ \" does not exist in \" \\+ this","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"warning","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/alias/AbstractJavaKeyStoreProvider.java","lineNumber":254,"sourceCode":"      }\n      return innerSetCredential(alias, credential);\n    } catch (KeyStoreException e) {\n      throw new IOException(\"Problem looking up credential \" + alias + \" in \"\n          + this, e);\n    } finally {\n      writeLock.unlock();\n    }\n  }\n\n  @Override\n  public void deleteCredentialEntry(String name) throws IOException {\n    writeLock.lock();\n    try {\n      try {\n        if (keyStore.containsAlias(name)) {\n          keyStore.deleteEntry(name);\n        } else {\n          throw new IOException(\"Credential \" + name + \" does not exist in \"\n              + this);\n        }\n      } catch (KeyStoreException e) {\n        throw new IOException(\"Problem removing \" + name + \" from \" + this, e);\n      }\n      changed = true;\n    } finally {\n      writeLock.unlock();\n    }\n  }\n\n  CredentialEntry innerSetCredential(String alias, char[] material)\n      throws IOException {\n    writeLock.lock();\n    try {\n      keyStore.setKeyEntry(alias,\n          new SecretKeySpec(new String(material).getBytes(StandardCharsets.UTF_8),\n              getAlgorithm()), password, null);","sourceCodeStart":236,"sourceCodeEnd":272,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/alias/AbstractJavaKeyStoreProvider.java#L236-L272","documentation":"deleteCredentialEntry() only deletes aliases that exist: containsAlias(name) returned false, so Hadoop refuses the delete. The alias is misspelled, already deleted, or the provider path resolves to a different keystore file than the one holding the credential.","triggerScenarios":"provider.deleteCredentialEntry(name) for an alias not in the store; 'hadoop credential delete <alias> -provider <path>' with a typo or wrong-case alias; create and delete executed against different provider URIs; store silently recreated empty because the password defaulted to 'none'.","commonSituations":"Retry logic in cleanup scripts deleting an alias that a previous run already removed; environments (dev/prod) with different keystore paths; case-sensitive alias mismatch.","solutions":["List what is actually there: hadoop credential list -provider <path>, and compare alias spelling exactly","Confirm the provider URI used for delete is byte-identical to the one used for create","Make deletes idempotent: treat 'does not exist' as success instead of failing the run"],"exampleFix":"// before\nprovider.deleteCredentialEntry(name);\n\n// after\nif (provider.getCredentialEntry(name) == null) {\n  LOG.info(\"Alias {} already absent; nothing to do\", name);\n} else {\n  provider.deleteCredentialEntry(name);\n  provider.flush();\n}","handlingStrategy":"validation","validationCode":"// Idempotent delete: confirm the alias exists first\nboolean exists = provider.getAliases().contains(name);\nif (exists) {\n  provider.deleteCredentialEntry(name);\n  provider.flush();\n}","typeGuard":"boolean aliasExists(CredentialProvider p, String name) throws IOException {\n  return p.getAliases().contains(name);\n}","tryCatchPattern":"try {\n  provider.deleteCredentialEntry(name);\n} catch (IOException ex) {\n  if (ex.getMessage() != null && ex.getMessage().contains(\"does not exist\")) {\n    LOG.info(\"Alias {} already gone - treating delete as success\", name);\n  } else { throw ex; }\n}","preventionTips":["Treat 'does not exist' on delete as success in cleanup scripts","Always derive the provider URI from one config source so create/delete/list hit the same store","Remember aliases are case-sensitive and often contain dotted key names - copy/paste, don't retype"],"tags":["hadoop","credential-provider","keystore","alias-not-found","jceks"],"backgroundTag":"keystore-alias-not-found","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}