{"record":{"id":"336c22dda1eb1927","repo":"apache/hadoop","slug":"can-t-get-algorithm-for-credential-alias-f","errorCode":null,"errorMessage":"Can't get algorithm for credential \" + alias + \" from \" + getPathAsString()","messagePattern":"Can't get algorithm for credential \" \\+ alias \\+ \" from \" \\+ getPathAsString\\(\\)","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/alias/AbstractJavaKeyStoreProvider.java","lineNumber":188,"sourceCode":"    }\n  }\n\n  @Override\n  public CredentialEntry getCredentialEntry(String alias)\n      throws IOException {\n    readLock.lock();\n    try {\n      SecretKeySpec key = null;\n      try {\n        if (!keyStore.containsAlias(alias)) {\n          return null;\n        }\n        key = (SecretKeySpec) keyStore.getKey(alias, password);\n      } catch (KeyStoreException e) {\n        throw new IOException(\"Can't get credential \" + alias + \" from \"\n            + getPathAsString(), e);\n      } catch (NoSuchAlgorithmException e) {\n        throw new IOException(\"Can't get algorithm for credential \" + alias\n            + \" from \" + getPathAsString(), e);\n      } catch (UnrecoverableKeyException e) {\n        throw new IOException(\"Can't recover credential \" + alias + \" from \"\n            + getPathAsString(), e);\n      }\n      return new CredentialEntry(alias, bytesToChars(key.getEncoded()));\n    } finally {\n      readLock.unlock();\n    }\n  }\n\n  public static char[] bytesToChars(byte[] bytes) throws IOException {\n    String pass;\n    pass = new String(bytes, StandardCharsets.UTF_8);\n    return pass.toCharArray();\n  }\n\n  @Override","sourceCodeStart":170,"sourceCodeEnd":206,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/alias/AbstractJavaKeyStoreProvider.java#L170-L206","documentation":"Thrown by AbstractJavaKeyStoreProvider.getCredentialEntry when KeyStore.getKey() fails with NoSuchAlgorithmException: the alias exists in the JCEKS store, but the current JVM's security providers cannot supply the algorithm needed to unwrap/recover the stored SecretKeySpec. It means the keystore entry was written under a JCE configuration the reading JVM does not have. The offending cause is chained on the IOException.","triggerScenarios":"Calling getCredentialEntry(alias) (directly or via hadoop credential list/-get flows that read entries) on a JCEKS file that was created by a different JVM/JCE provider set; JVMs missing SunJCE or a custom provider that was present at write time; older Java 7/8 builds with restricted JCE policy; FIPS-hardened JVMs that disable the needed algorithm.","commonSituations":"Keystore created on OpenJDK 11 but read on an old JRE 7 client; IBM J9 to OpenJDK migration; a BouncyCastle-based tool wrote the entry and BC is not on the Hadoop classpath at read time; JDK downgrades in the cluster.","solutions":["Read the store with the same JVM family/version (and the same security providers) that created it","Check the installed providers (java.security + Security.getProviders()); add the missing provider jar to the classpath or java.security file","On Java < 8u161 install the unlimited JCE policy files, or upgrade to 8u161+ where they are default","Recreate the keystore with Hadoop's own tooling (hadoop credential create -provider jceks://...) so entries use the standard AES SecretKeySpec, and re-add all secrets"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// Pre-flight: confirm the JCE registry can supply AES before reading entries\nimport javax.crypto.Cipher;\nimport java.security.Security;\n\nboolean jceOk(String algorithm) {\n  try {\n    Cipher.getMaxAllowedKeyLength(algorithm); // touches JCE policy\n    return Security.getProviders().length > 0; // and check SunJCE presence if needed\n  } catch (Exception e) {\n    return false;\n  }\n}","typeGuard":null,"tryCatchPattern":"try {\n  CredentialEntry e = provider.getCredentialEntry(alias);\n} catch (IOException ex) {\n  if (ex.getCause() instanceof java.security.NoSuchAlgorithmException) {\n    // JVM/provider mismatch with the keystore writer - do not retry here;\n    // fix the JVM provider set or re-create the store on this JVM\n  } else { throw ex; }\n}","preventionTips":["Create and read credential stores with the same JDK vendor and version across the cluster","Keep custom JCE providers on the classpath of every process that opens the store, not just the writer","Standardize on Hadoop tooling (hadoop credential) to create stores so entries always use default AES"],"tags":["hadoop","credential-provider","keystore","jceks","jce-provider","security"],"backgroundTag":"jce-algorithm-not-available","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-23T01:17:44.959Z"}