{"record":{"id":"0c1de033845e6e71","repo":"apache/hadoop","slug":"keyprovider-keyprovider-was-found-but-it-is-a-t","errorCode":null,"errorMessage":"KeyProvider ${keyProvider} was found but it is a transient provider.","messagePattern":"KeyProvider (.+?) was found but it is a transient provider\\.","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/util/KMSUtil.java","lineNumber":89,"sourceCode":"  public static URI getKeyProviderUri(final Configuration conf,\n                                      final String configKeyName) {\n    final String providerUriStr = conf.getTrimmed(configKeyName);\n    // No provider set in conf\n    if (providerUriStr == null || providerUriStr.isEmpty()) {\n      return null;\n    }\n    return URI.create(providerUriStr);\n  }\n\n  public static KeyProvider createKeyProviderFromUri(final Configuration conf,\n      final URI providerUri) throws IOException {\n    KeyProvider keyProvider = KeyProviderFactory.get(providerUri, conf);\n    if (keyProvider == null) {\n      throw new IOException(\"Could not instantiate KeyProvider for uri: \" +\n          providerUri);\n    }\n    if (keyProvider.isTransient()) {\n      throw new IOException(\"KeyProvider \" + keyProvider.toString()\n          + \" was found but it is a transient provider.\");\n    }\n    return keyProvider;\n  }\n\n  @SuppressWarnings(\"unchecked\")\n  public static Map toJSON(KeyProvider.KeyVersion keyVersion) {\n    Map json = new HashMap();\n    if (keyVersion != null) {\n      json.put(KMSRESTConstants.NAME_FIELD,\n          keyVersion.getName());\n      json.put(KMSRESTConstants.VERSION_NAME_FIELD,\n          keyVersion.getVersionName());\n      json.put(KMSRESTConstants.MATERIAL_FIELD,\n          Base64.encodeBase64URLSafeString(\n              keyVersion.getMaterial()));\n    }\n    return json;","sourceCodeStart":71,"sourceCodeEnd":107,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/util/KMSUtil.java#L71-L107","documentation":"Even a successfully constructed provider is rejected when isTransient() is true: KMSUtil throws IOException(\"KeyProvider ... was found but it is a transient provider\") because the calling features (encryption-zone keys, KMS delegation tokens) require a durable shared key store, not an in-memory one such as the 'user://' UserProvider.","triggerScenarios":"hadoop.security.key.provider.path set to user:// (or resolving to the in-memory UserProvider) while the code path needs a durable provider - for example creating encryption zones or requesting delegation tokens.","commonSituations":"core-site stripped down for local tests so the KMS URI is gone; a fallback default of user:// taking effect; provider resolution order selecting UserProvider ahead of the configured KMS provider.","solutions":["Set hadoop.security.key.provider.path to a durable provider URI, e.g. kms://https@kms-host:9600/kms, in core-site.","Restart the service or CLI so the provider is rebuilt from the corrected configuration.","Check which provider the factory actually selected (the exception names it) and remove the competing user:// entry."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"URI uri = URI.create(conf.getTrimmed(\"hadoop.security.key.provider.path\"));\nif (\"user\".equalsIgnoreCase(uri.getScheme())) {\n  throw new IllegalStateException(\n      \"user:// provider is transient; configure kms://https@host:9600/kms\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never rely on user:// outside throwaway local tests.","Assert the resolved provider's isTransient() is false in a startup self-check."],"tags":["kms","encryption","security","hadoop-common","configuration"],"backgroundTag":"transient-key-provider","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}