{"record":{"id":"369e7a1f79868fe9","repo":"apache/beam","slug":"exception-while-retrieving-credentials","errorCode":null,"errorMessage":"exception while retrieving credentials","messagePattern":"exception while retrieving credentials","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"sdks/java/io/google-cloud-platform/src/main/java/org/apache/beam/sdk/io/gcp/bigtable/BigtableConfigTranslator.java","lineNumber":432,"sourceCode":"              KeyStore keyStore = KeyStore.getInstance(\"PKCS12\");\n\n              try (FileInputStream fin = new FileInputStream(keyFile)) {\n                keyStore.load(fin, \"notasecret\".toCharArray());\n              }\n              PrivateKey privateKey =\n                  (PrivateKey) keyStore.getKey(\"privatekey\", \"notasecret\".toCharArray());\n\n              if (privateKey == null) {\n                throw new IllegalStateException(\"private key cannot be null\");\n              }\n              Credentials credentials =\n                  ServiceAccountJwtAccessCredentials.newBuilder()\n                      .setClientEmail(serviceAccount)\n                      .setPrivateKey(privateKey)\n                      .build();\n              builder.setCredentialFactory(FixedCredentialFactory.create(credentials));\n            } catch (GeneralSecurityException exception) {\n              throw new RuntimeException(\"exception while retrieving credentials\", exception);\n            }\n            break;\n          case SuppliedCredentials:\n            Credentials credentials =\n                ((CredentialOptions.UserSuppliedCredentialOptions) credOptions).getCredential();\n            builder.setCredentialFactory(FixedCredentialFactory.create(credentials));\n            break;\n          case SuppliedJson:\n            CredentialOptions.JsonCredentialsOptions jsonCredentialsOptions =\n                (CredentialOptions.JsonCredentialsOptions) credOptions;\n            builder.setCredentialFactory(\n                FixedCredentialFactory.create(\n                    GoogleCredentials.fromStream(jsonCredentialsOptions.getInputStream())));\n            break;\n          case None:\n            // pipelineOptions is ignored\n            PipelineOptions pipelineOptions = PipelineOptionsFactory.create();\n            builder.setCredentialFactory(NoopCredentialFactory.fromOptions(pipelineOptions));","sourceCodeStart":414,"sourceCodeEnd":450,"githubUrl":"https://github.com/apache/beam/blob/12126d8942aaf848030c478b4c6a28c6af861c66/sdks/java/io/google-cloud-platform/src/main/java/org/apache/beam/sdk/io/gcp/bigtable/BigtableConfigTranslator.java#L414-L450","documentation":"While building service-account credentials from a .p12 key file in BigtableConfigTranslator.translateToBigtableConfig, a GeneralSecurityException can be thrown by KeyStore loading or ServiceAccountJwtAccessCredentials construction. The translator wraps it in a RuntimeException('exception while retrieving credentials') so pipeline translation fails fast with the cause attached.","triggerScenarios":"keyStore.load() on a malformed/encrypted-corrupt .p12 file, or ServiceAccountJwtAccessCredentials.newBuilder().setPrivateKey(privateKey).build() rejecting the key material; triggered by service-account credential options with an inaccessible or invalid key file.","commonSituations":"Corrupt or truncated .p12 file, wrong file downloaded (e.g. an HTML error page saved as .p12), JCE provider issues with PKCS12 in restricted environments, key file with unexpected encryption/password.","solutions":["Check the chained cause (getCause()) for the underlying GeneralSecurityException to identify the exact keystore problem","Re-download the service account .p12 key from Cloud Console to replace a corrupt file","Switch to Application Default Credentials (omit credential options) so no keystore parsing is needed","Use UserSuppliedCredentialOptions with Credentials built via GoogleCredentials.getApplicationDefault() in your own code"],"exampleFix":"// before\nBigtableIO.write().withCredentialOptions(BigtableIO.CredentialOptions.serviceAccountCredentialOptions(corruptP12Path, \"sa@project.iam.gserviceaccount.com\"))\n// after\nBigtableIO.write().withCredentialOptions(BigtableIO.CredentialOptions.userSuppliedCredentials(GoogleCredentials.getApplicationDefault()))","handlingStrategy":"try-catch","validationCode":"if (!new File(p12Path).canRead()) throw new IllegalStateException(\"Key file unreadable: \" + p12Path);","typeGuard":null,"tryCatchPattern":"try {\n  // pipeline build with service account credential options\n} catch (RuntimeException e) {\n  if (e.getCause() instanceof GeneralSecurityException) {\n    // replace key file or fall back to ADC\n    GoogleCredentials adc = GoogleCredentials.getApplicationDefault();\n  }\n  throw e;\n}","preventionTips":["Fall back to Application Default Credentials in GCP environments (Dataflow, GCE) instead of key files","Validate .p12 files load with keytool before deployment","Log the cause chain to distinguish corrupt files from provider issues"],"tags":["java","bigtable","credentials","security"],"backgroundTag":"missing-credentials","analyzedSha":"12126d8942aaf848030c478b4c6a28c6af861c66","analyzedAt":"2026-09-13T01:50:10.254Z","contentChangedAt":"2026-09-13T01:50:10.254Z","schemaVersion":2},"datasetVersion":"2026-09-20T03:17:13.778Z"}