{"record":{"id":"1bc344b74569975a","repo":"apache/beam","slug":"problems-while-retrieving-application-default-credentials","errorCode":null,"errorMessage":"Problems while retrieving application default credentials.","messagePattern":"Problems while retrieving application default credentials\\.","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"sdks/java/io/amazon-web-services2/src/main/java/org/apache/beam/sdk/io/aws2/auth/GoogleADCIdTokenProvider.java","lineNumber":52,"sourceCode":" * resources use a similar configuration to:\n *\n * <pre>{@code --awsCredentialsProvider={\n *   \"@type\": \"StsAssumeRoleForFederatedCredentialsProvider\",\n *   \"roleArn\": \"<the AWS ARN of the role to be assumed by the pipeline>\",\n *   \"audience\": \"<the configured Audience for the federated authentication>\",\n *   \"webIdTokenProviderFQCN\": \"org.apache.beam.sdk.io.aws2.auth.GoogleADCIdTokenProvider\",\n *   \"durationSeconds\": 3600\n * }}</pre>\n */\n@SuppressFBWarnings(value = \"CT_CONSTRUCTOR_THROW\", justification = \"Initialization is safe.\")\npublic class GoogleADCIdTokenProvider implements WebIdTokenProvider {\n  private final IdTokenProvider idTokenProvider;\n\n  public GoogleADCIdTokenProvider() {\n    try {\n      this.idTokenProvider = (IdTokenProvider) GoogleCredentials.getApplicationDefault();\n    } catch (IOException ex) {\n      throw new RuntimeException(\"Problems while retrieving application default credentials.\", ex);\n    }\n  }\n\n  @VisibleForTesting\n  IdTokenCredentials createIdTokenWithApplicationDefaultCredentials(String audience) {\n    return IdTokenCredentials.newBuilder()\n        .setIdTokenProvider(this.idTokenProvider)\n        .setTargetAudience(audience)\n        .setOptions(Arrays.asList(Option.FORMAT_FULL, Option.LICENSES_TRUE))\n        .build();\n  }\n\n  @Override\n  public String resolveTokenValue(String audience) {\n    try {\n      return createIdTokenWithApplicationDefaultCredentials(audience)\n          .refreshAccessToken()\n          .getTokenValue();","sourceCodeStart":34,"sourceCodeEnd":70,"githubUrl":"https://github.com/apache/beam/blob/12126d8942aaf848030c478b4c6a28c6af861c66/sdks/java/io/amazon-web-services2/src/main/java/org/apache/beam/sdk/io/aws2/auth/GoogleADCIdTokenProvider.java#L34-L70","documentation":"GoogleADCIdTokenProvider's constructor throws a RuntimeException wrapping the IOException from GoogleCredentials.getApplicationDefault() when Google Application Default Credentials cannot be located or read, or when the found credentials are not an IdTokenProvider (ClassCastException path aside, the documented failure is ADC retrieval). Constructing this provider therefore fails fast if the environment has no usable ADC.","triggerScenarios":"new GoogleADCIdTokenProvider() when ADC is absent (no GOOGLE_APPLICATION_CREDENTIALS, no gcloud user credentials, no metadata server) or unreadable, or when the resolved credential type does not implement IdTokenProvider.","commonSituations":"Running locally without `gcloud auth application-default login`; missing GOOGLE_APPLICATION_CREDENTIALS env var; service-account key lacking token-creation scope; deploying on infra without a GCE metadata server; key file path invalid.","solutions":["Set GOOGLE_APPLICATION_CREDENTIALS to a valid service-account JSON key","Run `gcloud auth application-default login` for local development","Ensure the code runs on GCP infrastructure with a metadata server, or provide explicit credentials","Verify the credential JSON is a service account that supports id tokens (not a user credential without IdTokenProvider support)"],"exampleFix":"// before: provider constructed eagerly, fails without ADC\nGoogleADCIdTokenProvider provider = new GoogleADCIdTokenProvider();\n// after: validate ADC availability first\ntry {\n  GoogleCredentials creds = GoogleCredentials.getApplicationDefault();\n  if (!(creds instanceof IdTokenProvider)) {\n    throw new IllegalStateException(\"ADC does not support id tokens\");\n  }\n  GoogleADCIdTokenProvider provider = new GoogleADCIdTokenProvider();\n} catch (IOException e) { /* configure credentials */ }","handlingStrategy":"validation","validationCode":"try {\n  GoogleCredentials creds = GoogleCredentials.getApplicationDefault();\n  if (!(creds instanceof IdTokenProvider)) {\n    throw new IllegalStateException(\"ADC lacks IdTokenProvider support\");\n  }\n} catch (IOException e) {\n  throw new IllegalStateException(\"Configure ADC first\", e);\n}","typeGuard":"boolean adcAvailable() {\n  try { return GoogleCredentials.getApplicationDefault() != null; }\n  catch (IOException e) { return false; }\n}","tryCatchPattern":"try {\n  GoogleADCIdTokenProvider p = new GoogleADCIdTokenProvider();\n} catch (RuntimeException e) {\n  logger.error(\"ADC unavailable: set GOOGLE_APPLICATION_CREDENTIALS\", e);\n  throw e;\n}","preventionTips":["Set GOOGLE_APPLICATION_CREDENTIALS before job launch","Use service-account keys that support id tokens","Run `gcloud auth application-default login` locally"],"tags":["java","gcp","authentication","aws-s3-oidc"],"backgroundTag":"missing-credentials","analyzedSha":"12126d8942aaf848030c478b4c6a28c6af861c66","analyzedAt":"2026-09-13T01:50:10.254Z","contentChangedAt":"2026-09-13T01:50:10.254Z","schemaVersion":2},"datasetVersion":"2026-09-20T03:17:13.778Z"}