{"record":{"id":"218df3e5e5c05aeb","repo":"apache/beam","slug":"azure-credential-provider-type-s-is-not-supported","errorCode":null,"errorMessage":"Azure credential provider type '%s' is not supported","messagePattern":"Azure credential provider type '(.+?)' is not supported","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"sdks/java/io/azure/src/main/java/org/apache/beam/sdk/io/azure/options/AzureModule.java","lineNumber":148,"sourceCode":"              .build();\n        } else {\n          return new ClientCertificateCredentialBuilder()\n              .clientId(asMap.getOrDefault(AZURE_CLIENT_ID, \"\"))\n              .pfxCertificate(\n                  asMap.getOrDefault(AZURE_PFX_CERTIFICATE_PATH, \"\"),\n                  asMap.getOrDefault(AZURE_PFX_CERTIFICATE_PASSWORD, \"\"))\n              .tenantId(asMap.getOrDefault(AZURE_TENANT_ID, \"\"))\n              .build();\n        }\n      } else if (typeName.equals(UsernamePasswordCredential.class.getSimpleName())) {\n        return new UsernamePasswordCredentialBuilder()\n            .clientId(asMap.getOrDefault(AZURE_CLIENT_ID, \"\"))\n            .username(asMap.getOrDefault(AZURE_USERNAME, \"\"))\n            .password(asMap.getOrDefault(AZURE_PASSWORD, \"\"))\n            .tenantId(asMap.getOrDefault(AZURE_TENANT_ID, \"\"))\n            .build();\n      } else {\n        throw new IOException(\n            String.format(\"Azure credential provider type '%s' is not supported\", typeName));\n      }\n    }\n  }\n\n  private static class TokenCredentialSerializer extends JsonSerializer<TokenCredential> {\n    @Override\n    public void serialize(\n        TokenCredential tokenCredential,\n        JsonGenerator jsonGenerator,\n        SerializerProvider serializers)\n        throws IOException {\n      serializers.defaultSerializeValue(tokenCredential, jsonGenerator);\n    }\n\n    @SuppressWarnings(\"nullness\")\n    private static Object getMember(Object obj, String member)\n        throws IllegalAccessException, NoSuchFieldException {","sourceCodeStart":130,"sourceCodeEnd":166,"githubUrl":"https://github.com/apache/beam/blob/12126d8942aaf848030c478b4c6a28c6af861c66/sdks/java/io/azure/src/main/java/org/apache/beam/sdk/io/azure/options/AzureModule.java#L130-L166","documentation":"After reading the type name, deserializeWithType only supports DefaultAzureCredential, ClientSecretCredential, ClientCertificateCredential, UsernamePasswordCredential and (per the visible branch) shared-token variants; anything else throws IOException \"Azure credential provider type '%s' is not supported\". The module has a fixed allowlist of credential classes it can reconstruct.","triggerScenarios":"Deserializing a payload whose type name is an unsupported TokenCredential subclass (e.g. ManagedIdentityCredential, AzureCliCredential, InteractiveBrowserCredential), or a typo'd/renamed type string.","commonSituations":"Serializing with one Azure SDK identity version and deserializing where the allowlist differs; hand-writing type names like \"EnvironmentCredential\" that the deserializer does not handle; custom TokenCredential implementations.","solutions":["Use a supported credential type such as DefaultAzureCredential or ClientSecretCredential.","Prefer DefaultAzureCredential, which resolves managed identity/CLI/environment credentials at runtime and serializes as a supported name.","Upgrade the Beam Azure SDK module if a newer version added support for your credential type.","Check the exact simple class name in the JSON matches what the deserializer expects (case-sensitive)."],"exampleFix":"// before\noptions.setCredential(new AzureCliCredentialBuilder().build()); // not supported on deserialize\n// after\noptions.setCredential(new DefaultAzureCredentialBuilder().build());","handlingStrategy":"validation","validationCode":"java.util.Set<String> supported = java.util.Set.of(\"DefaultAzureCredential\", \"ClientSecretCredential\",\n    \"ClientCertificateCredential\", \"UsernamePasswordCredential\");\nif (!supported.contains(typeName)) {\n  throw new IllegalArgumentException(\"credential type not deserializable: \" + typeName);\n}","typeGuard":null,"tryCatchPattern":"try {\n  return deserialize(json);\n} catch (IOException e) {\n  if (e.getMessage().contains(\"not supported\")) {\n    throw new IllegalStateException(\"swap to DefaultAzureCredential/ClientSecretCredential\", e);\n  }\n  throw e;\n}","preventionTips":["Restrict pipeline credentials to DefaultAzureCredential or ClientSecretCredential","Match simple class names exactly (case-sensitive) in serialized payloads","Keep azure-identity and Beam io-azure versions aligned","Build runtime-only credentials (CLI, interactive) outside serialized options"],"tags":["java","jackson","azure-credentials","unsupported-type","serialization"],"backgroundTag":"unsupported-enum-value","analyzedSha":"12126d8942aaf848030c478b4c6a28c6af861c66","analyzedAt":"2026-09-13T01:50:10.254Z","contentChangedAt":"2026-09-13T01:50:10.254Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}