{"record":{"id":"2f00b6dcabf72132","repo":"pentaho/pentaho-kettle","slug":"symmetriccryptotrans-exception-secretkeyfieldmissing","errorCode":"SymmetricCryptoTrans.Exception.SecretKeyFieldMissing","errorMessage":"SymmetricCryptoTrans.Exception.SecretKeyFieldMissing","messagePattern":"SymmetricCryptoTrans\\.Exception\\.SecretKeyFieldMissing","errorType":"exception","errorClass":"KettleStepException","httpStatus":null,"severity":"error","filePath":"engine/src/main/java/org/pentaho/di/trans/steps/symmetriccrypto/symmetriccryptotrans/SymmetricCryptoTrans.java","lineNumber":109,"sourceCode":"        throw new KettleStepException( BaseMessages.getString(\n          PKG, \"SymmetricCryptoTrans.Exception.CouldnotFindField\", meta.getMessageFied() ) );\n      }\n\n      if ( !meta.isSecretKeyInField() ) {\n        String realSecretKey =\n          Encr.decryptPasswordOptionallyEncrypted( environmentSubstitute( meta.getSecretKey() ) );\n        if ( Utils.isEmpty( realSecretKey ) ) {\n          throw new KettleStepException( BaseMessages.getString(\n            PKG, \"SymmetricCryptoTrans.Exception.SecretKeyMissing\" ) );\n        }\n        // We have a static secret key\n        // Set secrete key\n        setSecretKey( realSecretKey );\n\n      } else {\n        // dynamic secret key\n        if ( Utils.isEmpty( meta.getSecretKeyField() ) ) {\n          throw new KettleStepException( BaseMessages.getString(\n            PKG, \"SymmetricCryptoTrans.Exception.SecretKeyFieldMissing\" ) );\n        }\n        // Try to get secret key field index\n        data.indexOfSecretkeyField = getInputRowMeta().indexOfValue( meta.getSecretKeyField() );\n\n        // Let's check the Field\n        if ( data.indexOfSecretkeyField < 0 ) {\n          // The field is unreachable !\n          throw new KettleStepException( BaseMessages.getString(\n            PKG, \"SymmetricCryptoTrans.Exception.CouldnotFindField\", meta.getSecretKeyField() ) );\n        }\n      }\n\n    }\n\n    try {\n\n      // handle dynamic secret key","sourceCodeStart":91,"sourceCodeEnd":127,"githubUrl":"https://github.com/pentaho/pentaho-kettle/blob/f3058517a153da500bf4551f46d79b91bf8ec552/engine/src/main/java/org/pentaho/di/trans/steps/symmetriccrypto/symmetriccryptotrans/SymmetricCryptoTrans.java#L91-L127","documentation":"When the secret key is read dynamically from the data stream (secretKeyInField = true), the step requires a secret key field name. processRow throws this KettleStepException when meta.getSecretKeyField() is empty, because it cannot know which incoming column holds the per-row key.","triggerScenarios":"'secret key in field' is enabled (or isSecretKeyInField() returns true from a loaded/legacy configuration) but the 'Secret key fieldname' option is empty in the step metadata.","commonSituations":"Programmatic construction where setSecretKeyInField(true) was called without setSecretKeyField(); metadata migration flipping the flag without updating the field; hand-edited transformation XML enabling secretKeyInField='Y' with no secretKeyField tag.","solutions":["In the step dialog select the secret key field name from the incoming fields.","Programmatically call meta.setSecretKeyField(\"keyColumn\") when secretKeyInField is true.","Alternatively disable 'secret key in field' and provide a static key, which bypasses this check."],"exampleFix":"// before\nmeta.setSecretKeyInField(true); // no key field set\n// after\nmeta.setSecretKeyInField(true);\nmeta.setSecretKeyField(\"secret_key\");","handlingStrategy":"validation","validationCode":"if (meta.isSecretKeyInField()\n    && (meta.getSecretKeyField() == null || meta.getSecretKeyField().isEmpty())) {\n  throw new IllegalArgumentException(\n    \"secretKeyInField=true requires a secret key field name\");\n}","typeGuard":null,"tryCatchPattern":"try {\n  trans.execute(null);\n} catch (KettleStepException e) {\n  if (e.getMessage().contains(\"SecretKeyFieldMissing\")) {\n    logError(\"Set the secret key field name or switch to a static key\");\n  }\n}","preventionTips":["Whenever enabling 'secret key in field', immediately set the key field name.","Run meta.check() before saving/executing to catch missing configuration.","Keep static-key and field-key modes clearly separated in your metadata builders."],"tags":["kettle","pdi","encryption","missing-field"],"backgroundTag":"missing-required-config-field","analyzedSha":"f3058517a153da500bf4551f46d79b91bf8ec552","analyzedAt":"2026-09-13T14:04:16.340Z","contentChangedAt":"2026-09-13T14:04:16.340Z","schemaVersion":2},"datasetVersion":"2026-09-20T23:17:15.980Z"}