{"record":{"id":"199dd8db12530c51","repo":"apache/hadoop","slug":"no-keyproviderfactory-for-uri-in-key-provider","errorCode":null,"errorMessage":"No KeyProviderFactory for ${uri} in ${KEY_PROVIDER_PATH}","messagePattern":"No KeyProviderFactory for (.+?) in (.+?)","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/KeyProviderFactory.java","lineNumber":72,"sourceCode":"  // Lazy loading would require synchronization in concurrent use cases.\n  static {\n    Iterator<KeyProviderFactory> iterServices = serviceLoader.iterator();\n    while (iterServices.hasNext()) {\n      iterServices.next();\n    }\n  }\n  \n  public static List<KeyProvider> getProviders(Configuration conf\n                                               ) throws IOException {\n    List<KeyProvider> result = new ArrayList<KeyProvider>();\n    for(String path: conf.getStringCollection(KEY_PROVIDER_PATH)) {\n      try {\n        URI uri = new URI(path);\n        KeyProvider kp = get(uri, conf);\n        if (kp != null) {\n          result.add(kp);\n        } else {\n          throw new IOException(\"No KeyProviderFactory for \" + uri + \" in \" +\n              KEY_PROVIDER_PATH);\n        }\n      } catch (URISyntaxException error) {\n        throw new IOException(\"Bad configuration of \" + KEY_PROVIDER_PATH +\n            \" at \" + path, error);\n      }\n    }\n    return result;\n  }\n\n  /**\n   * Create a KeyProvider based on a provided URI.\n   *\n   * @param uri key provider URI\n   * @param conf configuration to initialize the key provider\n   * @return the key provider for the specified URI, or <code>NULL</code> if\n   *         a provider for the specified URI scheme could not be found.\n   * @throws IOException thrown if the provider failed to initialize.","sourceCodeStart":54,"sourceCodeEnd":90,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/KeyProviderFactory.java#L54-L90","documentation":"KeyProviderFactory.getProviders parses each entry of hadoop.security.key.provider.path as a URI and asks every KeyProviderFactory registered via ServiceLoader; if none accepts the URI (get(uri, conf) returns null), the entry is unusable and the whole call fails with 'No KeyProviderFactory for <uri>'. The URI scheme determines which factory handles it (jceks, user, kms, ...).","triggerScenarios":"A scheme typo such as 'jkse://' or 'kms:/host'; a scheme whose implementing jar (e.g. hadoop-kms) is missing from the classpath so its ServiceLoader entry is absent; a raw file path with no scheme that no factory claims.","commonSituations":"Hand-editing core-site.xml provider paths; mixing up formats between jceks://file/abs/path, user:/// and kms://https://host:9600/kms; shaded/classloader setups that hide META-INF/services entries.","solutions":["Use a supported scheme in exact form: jceks://file/abs/path, user:///, kms://https://host:9600/kms","Re-check the scheme spelling in hadoop.security.key.provider.path","Ensure the provider implementation jar and its META-INF/services/org.apache.hadoop.crypto.key.KeyProviderFactory file are on the classpath","Isolate the bad entry: test each URI with `hadoop key list -provider <uri>`"],"exampleFix":"<!-- before (core-site.xml) -->\n<property><name>hadoop.security.key.provider.path</name><value>jkse://file/keys.jceks</value></property>\n\n<!-- after -->\n<property><name>hadoop.security.key.provider.path</name><value>jceks://file/keys.jceks</value></property>","handlingStrategy":"validation","validationCode":"static final Set<String> SCHEMES = Set.of(\"jceks\", \"user\", \"kms\");\nfor (String entry : conf.getStringCollection(\"hadoop.security.key.provider.path\")) {\n  URI u = new URI(entry);\n  if (!SCHEMES.contains(u.getScheme())) {\n    throw new IllegalArgumentException(\"unsupported provider scheme: \" + entry);\n  }\n}\nList<KeyProvider> providers = KeyProviderFactory.getProviders(conf);","typeGuard":null,"tryCatchPattern":"try { providers = KeyProviderFactory.getProviders(conf); } catch (IOException e) { if (String.valueOf(e.getMessage()).startsWith(\"No KeyProviderFactory\")) { // fix scheme/classpath for the named URI, then rebuild config } else { throw e; } }","preventionTips":["Validate provider URIs at config load time, not at first key operation","Copy canonical provider URI formats from current Hadoop docs","Verify provider jars and META-INF/services entries when shading"],"tags":["java","hadoop","key-provider","configuration","uri-scheme","classpath"],"backgroundTag":"unsupported-provider-scheme","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-23T01:17:44.959Z"}