{"record":{"id":"313064cc05ea8592","repo":"apache/hadoop","slug":"could-not-instantiate-keyprovider-for-uri-provi","errorCode":null,"errorMessage":"Could not instantiate KeyProvider for uri: ${providerUri}","messagePattern":"Could not instantiate KeyProvider for uri: (.+?)","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/util/KMSUtil.java","lineNumber":85,"sourceCode":"    return KMSUtil.getKeyProviderUri(\n        conf, KeyProviderFactory.KEY_PROVIDER_PATH);\n  }\n\n  public static URI getKeyProviderUri(final Configuration conf,\n                                      final String configKeyName) {\n    final String providerUriStr = conf.getTrimmed(configKeyName);\n    // No provider set in conf\n    if (providerUriStr == null || providerUriStr.isEmpty()) {\n      return null;\n    }\n    return URI.create(providerUriStr);\n  }\n\n  public static KeyProvider createKeyProviderFromUri(final Configuration conf,\n      final URI providerUri) throws IOException {\n    KeyProvider keyProvider = KeyProviderFactory.get(providerUri, conf);\n    if (keyProvider == null) {\n      throw new IOException(\"Could not instantiate KeyProvider for uri: \" +\n          providerUri);\n    }\n    if (keyProvider.isTransient()) {\n      throw new IOException(\"KeyProvider \" + keyProvider.toString()\n          + \" was found but it is a transient provider.\");\n    }\n    return keyProvider;\n  }\n\n  @SuppressWarnings(\"unchecked\")\n  public static Map toJSON(KeyProvider.KeyVersion keyVersion) {\n    Map json = new HashMap();\n    if (keyVersion != null) {\n      json.put(KMSRESTConstants.NAME_FIELD,\n          keyVersion.getName());\n      json.put(KMSRESTConstants.VERSION_NAME_FIELD,\n          keyVersion.getVersionName());\n      json.put(KMSRESTConstants.MATERIAL_FIELD,","sourceCodeStart":67,"sourceCodeEnd":103,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/util/KMSUtil.java#L67-L103","documentation":"KMSUtil.createKeyProviderFromUri delegates to KeyProviderFactory.get(uri, conf), which asks every registered provider whether it handles the URI's scheme. If none accepts it, get() returns null and KMSUtil throws IOException(\"Could not instantiate KeyProvider for uri: <uri>\"). This is a resolution failure - the scheme matched nothing on the classpath - not a failure to reach a KMS server.","triggerScenarios":"The provider URI in configuration (e.g. hadoop.security.key.provider.path) has an unsupported or misspelled scheme - 'kms:/https@...' missing a slash, or a bare path with no scheme - or the KMS client jar or the ServiceLoader registration for KeyProviderFactory is missing from the classpath.","commonSituations":"Hand-edited core-site with a malformed kms:// URI; a shaded application jar that dropped META-INF/services entries; a custom KeyProvider not registered via hadoop.security.provider.services; an older Hadoop distro missing the KMS client.","solutions":["Verify the exact URI from config - it must be fully formed, e.g. kms://https@kms-host:9600/kms.","Confirm the KMS client jars and their META-INF/services/org.apache.hadoop.crypto.key.KeyProviderFactory files are on the classpath (unzip -l the deployed jars).","For custom providers, register the service in core-site under hadoop.security.provider.services and redeploy."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"URI uri = KMSUtil.getProviderUri(conf, keyName);\nif (uri == null || uri.getScheme() == null) {\n  throw new IllegalArgumentException(\n      \"Missing or scheme-less \" + keyName + \" in configuration\");\n}","typeGuard":null,"tryCatchPattern":"try {\n  KeyProvider kp = KMSUtil.createKeyProviderFromUri(conf, providerUri);\n} catch (IOException e) {\n  // resolution failure: no registered provider accepts the URI scheme\n  // fix the URI in config or the client jar on the classpath, then retry\n}","preventionTips":["Validate the provider URI (scheme present, kms:// fully formed) at service startup.","After shading, verify META-INF/services files survived in the fat jar."],"tags":["kms","encryption","security","hadoop-common","configuration"],"backgroundTag":"key-provider-not-found","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-23T01:17:44.959Z"}