{"record":{"id":"230cf15fdb8adf6d","repo":"apache/hadoop","slug":"can-t-get-credential-alias-from-getpat","errorCode":null,"errorMessage":"Can't get credential \" + alias + \" from \" + getPathAsString()","messagePattern":"Can't get credential \" \\+ alias \\+ \" from \" \\+ getPathAsString\\(\\)","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/alias/AbstractJavaKeyStoreProvider.java","lineNumber":185,"sourceCode":"    path = ProviderUtils.unnestUri(keystoreUri);\n    if (LOG.isDebugEnabled()) {\n      LOG.debug(\"backing jks path initialized to \" + path);\n    }\n  }\n\n  @Override\n  public CredentialEntry getCredentialEntry(String alias)\n      throws IOException {\n    readLock.lock();\n    try {\n      SecretKeySpec key = null;\n      try {\n        if (!keyStore.containsAlias(alias)) {\n          return null;\n        }\n        key = (SecretKeySpec) keyStore.getKey(alias, password);\n      } catch (KeyStoreException e) {\n        throw new IOException(\"Can't get credential \" + alias + \" from \"\n            + getPathAsString(), e);\n      } catch (NoSuchAlgorithmException e) {\n        throw new IOException(\"Can't get algorithm for credential \" + alias\n            + \" from \" + getPathAsString(), e);\n      } catch (UnrecoverableKeyException e) {\n        throw new IOException(\"Can't recover credential \" + alias + \" from \"\n            + getPathAsString(), e);\n      }\n      return new CredentialEntry(alias, bytesToChars(key.getEncoded()));\n    } finally {\n      readLock.unlock();\n    }\n  }\n\n  public static char[] bytesToChars(byte[] bytes) throws IOException {\n    String pass;\n    pass = new String(bytes, StandardCharsets.UTF_8);\n    return pass.toCharArray();","sourceCodeStart":167,"sourceCodeEnd":203,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/alias/AbstractJavaKeyStoreProvider.java#L167-L203","documentation":"AbstractJavaKeyStoreProvider.getCredentialEntry looks an alias up in a Java KeyStore; a KeyStoreException from getKey() - keystore not initialized/loaded, or internally inconsistent - is wrapped in this IOException naming the alias and the keystore path. (Distinct from the sibling catches: NoSuchAlgorithmException and UnrecoverableKeyException produce different messages.)","triggerScenarios":"keyStore.getKey(alias, password) throwing KeyStoreException: the underlying JCEKS/JavaKeyStore was never loaded successfully - file missing, zero bytes, truncated by a failed write, or wrong keystore format - while containsAlias(alias) returned true or the store is in a half-open state.","commonSituations":"Credential store file corrupted or truncated (concurrent creation, disk full, kill during write); hadoop.security.credential.provider.path pointing to a missing file; a JCEKS file replaced with a PKCS12 (or vice versa); partial permissions preventing read of an existing store.","solutions":["Validate the store from CLI: `hadoop credential list -provider jceks://file/path/to/store.jceks`","Verify the provider path in config resolves to an existing, readable, non-empty file with correct owner/permissions","If the file is corrupt, recreate it and re-add secrets: `hadoop credential create <alias> -provider ...`","Confirm the keystore password source (hadoop.security.credential.clear-text-fallback / provider password file or env) matches how the store was created"],"exampleFix":"# before: provider path points at a truncated store\n# after: recreate and verify the store\nhadoop credential create my.secret -provider jceks://file/etc/hadoop/store.jceks\nhadoop credential list -provider jceks://file/etc/hadoop/store.jceks","handlingStrategy":"try-catch","validationCode":"org.apache.hadoop.conf.Configuration conf = new org.apache.hadoop.conf.Configuration();\nString provider = \"jceks://file/etc/hadoop/creds.jceks\";\njava.nio.file.Path p = java.nio.file.Paths.get(\n    provider.substring(provider.indexOf(\"://file/\") + 7));\nif (!java.nio.file.Files.exists(p) || java.nio.file.Files.size(p) == 0) {\n  throw new IllegalStateException(\"credential store missing or empty: \" + p);\n}","typeGuard":null,"tryCatchPattern":"try {\n  CredentialEntry ce = provider.getCredentialEntry(alias);\n} catch (IOException e) {\n  if (e.getMessage() != null && e.getMessage().contains(\"Can't get credential\")) {\n    // keystore-level failure (not a missing alias, which returns null)\n    LOG.error(\"credential store unusable for alias {}\", alias, e);\n  }\n  throw e;\n}","preventionTips":["Remember getCredentialEntry returns null for a missing alias - an IOException means the store itself is broken","Create/verify stores with `hadoop credential list -provider ...` before deploying","Protect store files from concurrent writers and keep disk space headroom"],"tags":["hadoop","credential-provider","keystore","jceks","io"],"backgroundTag":"keystore-load-failed","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}