{"record":{"id":"2b3ec864e2017c5f","repo":"apache/hadoop","slug":"can-t-recover-credential-alias-from-ge","errorCode":null,"errorMessage":"Can't recover credential \" + alias + \" from \" + getPathAsString()","messagePattern":"Can't recover credential \" \\+ alias \\+ \" from \" \\+ getPathAsString\\(\\)","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/alias/AbstractJavaKeyStoreProvider.java","lineNumber":191,"sourceCode":"  @Override\n  public CredentialEntry getCredentialEntry(String alias)\n      throws IOException {\n    readLock.lock();\n    try {\n      SecretKeySpec key = null;\n      try {\n        if (!keyStore.containsAlias(alias)) {\n          return null;\n        }\n        key = (SecretKeySpec) keyStore.getKey(alias, password);\n      } catch (KeyStoreException e) {\n        throw new IOException(\"Can't get credential \" + alias + \" from \"\n            + getPathAsString(), e);\n      } catch (NoSuchAlgorithmException e) {\n        throw new IOException(\"Can't get algorithm for credential \" + alias\n            + \" from \" + getPathAsString(), e);\n      } catch (UnrecoverableKeyException e) {\n        throw new IOException(\"Can't recover credential \" + alias + \" from \"\n            + getPathAsString(), e);\n      }\n      return new CredentialEntry(alias, bytesToChars(key.getEncoded()));\n    } finally {\n      readLock.unlock();\n    }\n  }\n\n  public static char[] bytesToChars(byte[] bytes) throws IOException {\n    String pass;\n    pass = new String(bytes, StandardCharsets.UTF_8);\n    return pass.toCharArray();\n  }\n\n  @Override\n  public List<String> getAliases() throws IOException {\n    readLock.lock();\n    try {","sourceCodeStart":173,"sourceCodeEnd":209,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/alias/AbstractJavaKeyStoreProvider.java#L173-L209","documentation":"Thrown when KeyStore.getKey() raises UnrecoverableKeyException inside getCredentialEntry: the password used to open the entry does not match the password the entry was stored with. For Hadoop keystore providers the store password comes from HADOOP_CREDSTORE_PASSWORD, the file named by hadoop.security.credential.store.password, or the default 'none'. In practice this almost always means the keystore password is wrong, not that the data is unrecoverable.","triggerScenarios":"Reading an alias with HADOOP_CREDSTORE_PASSWORD unset or different from the one used when the store was created; the password-file property pointing at a missing/stale file so the default 'none' is silently used; the store was created by another tool (keytool) or another team with a different password.","commonSituations":"Password env var exported in the admin's shell but not in the service/CI environment; store created with a real password then read in a session where only 'none' defaults apply; shared cluster keystore rotated without re-exporting the variable.","solutions":["Export the correct store password: HADOOP_CREDSTORE_PASSWORD=<pw> (or configure hadoop.security.credential.store.password to a readable password file)","Verify with an independent tool that the password is right: keytool -list -keystore <file> -storetype jceks -storepass <pw>","Confirm the provider is picking the password source you think (provider.needsPassword() / noPasswordWarning() log output)","If the password is truly lost, there is no recovery: recreate the keystore and re-add every credential"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Fail fast if the store password is not resolvable before any entry read\nAbstractJavaKeyStoreProvider ajkp = (AbstractJavaKeyStoreProvider) provider;\nif (ajkp.needsPassword()) {\n  throw new IllegalStateException(\n      \"Set HADOOP_CREDSTORE_PASSWORD or \" +\n      AbstractJavaKeyStoreProvider.CREDENTIAL_PASSWORD_FILE_KEY);\n}","typeGuard":null,"tryCatchPattern":"try {\n  provider.getCredentialEntry(alias);\n} catch (IOException ex) {\n  if (ex.getCause() instanceof java.security.UnrecoverableKeyException) {\n    // wrong store password: prompt/reconfigure HADOOP_CREDSTORE_PASSWORD, never brute-force in a loop\n  } else { throw ex; }\n}","preventionTips":["Export HADOOP_CREDSTORE_PASSWORD (or configure the password file) in every environment that reads the store","Verify the password once with keytool -list -storetype jceks before wiring Hadoop config","Treat the password as part of the keystore artifact: rotate both together and document which envs hold which"],"tags":["hadoop","credential-provider","keystore","password","jceks"],"backgroundTag":"keystore-password-mismatch","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}