{"record":{"id":"3410565cc15e79ba","repo":"pentaho/pentaho-kettle","slug":"randomvalue-log-secretkeynull","errorCode":null,"errorMessage":"RandomValue.Log.SecretKeyNull","messagePattern":"RandomValue\\.Log\\.SecretKeyNull","errorType":"exception","errorClass":"KettleException","httpStatus":null,"severity":"error","filePath":"engine/src/main/java/org/pentaho/di/trans/steps/randomvalue/RandomValue.java","lineNumber":121,"sourceCode":"    return row;\n  }\n\n  private String generateRandomMACHash( int algorithm ) throws Exception {\n    // Generates a secret key\n    SecretKey sk = null;\n    switch ( algorithm ) {\n      case RandomValueMeta.TYPE_RANDOM_MAC_HMACMD5:\n        sk = data.keyGenHmacMD5.generateKey();\n        break;\n      case RandomValueMeta.TYPE_RANDOM_MAC_HMACSHA1:\n        sk = data.keyGenHmacSHA1.generateKey();\n        break;\n      default:\n        break;\n    }\n\n    if ( sk == null ) {\n      throw new KettleException( BaseMessages.getString( PKG, \"RandomValue.Log.SecretKeyNull\" ) );\n    }\n\n    // Create a MAC object using HMAC and initialize with key\n    Mac mac = Mac.getInstance( sk.getAlgorithm() );\n    mac.init( sk );\n    // digest\n    byte[] hashCode = mac.doFinal();\n    StringBuilder encoded = new StringBuilder();\n    for ( int i = 0; i < hashCode.length; i++ ) {\n      String _b = Integer.toHexString( hashCode[i] );\n      if ( _b.length() == 1 ) {\n        _b = \"0\" + _b;\n      }\n      encoded.append( _b.substring( _b.length() - 2 ) );\n    }\n\n    return encoded.toString();\n","sourceCodeStart":103,"sourceCodeEnd":139,"githubUrl":"https://github.com/pentaho/pentaho-kettle/blob/f3058517a153da500bf4551f46d79b91bf8ec552/engine/src/main/java/org/pentaho/di/trans/steps/randomvalue/RandomValue.java#L103-L139","documentation":"RandomValue.generateRandomMACHash throws when the secret key (SecretKey) needed to build the HMAC Mac instance is null. The selected random-value function requires an HMAC key (e.g. random HMAC SHA-256 generator types), and none was supplied or derivable from the password/variable, so no MAC can be initialized.","triggerScenarios":"Using a Random Value step with an HMAC-type function while no secret key is configured — the key field/password resolves to null at runtime (empty variable, unset environment substitution, or null passed to getRandomValue).","commonSituations":"HMAC generator configured in a cluster/agent environment where the key variable isn't set; user typed key in wrong field; migrating metadata where the password field was not exported.","solutions":["Set the secret key field/password in the Random Value step configuration","Ensure the variable used for the key is defined at runtime (check setVariables/kettle.properties)","If deriving the key programmatically, pass a non-null SecretKey to getRandomValue"],"exampleFix":"// before\nSecretKey sk = resolveKey(variables.getVariable(\"HMAC_KEY\")); // null if unset\nMac mac = Mac.getInstance(sk.getAlgorithm());\n// after\nString keyStr = variables.getVariable(\"HMAC_KEY\");\nif (keyStr == null || keyStr.isEmpty()) {\n  throw new KettleException(\"RandomValue HMAC key variable HMAC_KEY is not set\");\n}\nSecretKey sk = new SecretKeySpec(keyStr.getBytes(StandardCharsets.UTF_8), \"HmacSHA256\");\nMac mac = Mac.getInstance(sk.getAlgorithm());","handlingStrategy":"validation","validationCode":"SecretKey sk = resolveSecretKey();\nif (sk == null || sk.getEncoded() == null || sk.getEncoded().length == 0) {\n  throw new IllegalArgumentException(\"HMAC secret key must be configured for this random value function\");\n}","typeGuard":"boolean hasSecretKey(SecretKey sk) { return sk != null && sk.getAlgorithm() != null && sk.getEncoded() != null && sk.getEncoded().length > 0; }","tryCatchPattern":"try { String v = getRandomValue(...); } catch (KettleException e) { if (e.getMessage().contains(\"SecretKeyNull\")) { logError(\"HMAC key missing — set the key variable or step field\"); } throw e; }","preventionTips":["Set the HMAC key variable in kettle.properties or via setVariable before execution","Fill the secret key/password field in the Random Value dialog when using HMAC functions","Verify variables resolve on every cluster slave, not just the master"],"tags":["kettle","hmac","secret-key","configuration"],"backgroundTag":"missing-credentials","analyzedSha":"f3058517a153da500bf4551f46d79b91bf8ec552","analyzedAt":"2026-09-13T14:04:16.340Z","contentChangedAt":"2026-09-13T14:04:16.340Z","schemaVersion":2},"datasetVersion":"2026-09-20T23:17:15.980Z"}