{"record":{"id":"4f83469cdd835610","repo":"apache/hadoop","slug":"can-t-store-credential-alias-in-this","errorCode":null,"errorMessage":"Can't store credential \" + alias + \" in \" + this","messagePattern":"Can't store credential \" \\+ alias \\+ \" in \" \\+ this","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/alias/AbstractJavaKeyStoreProvider.java","lineNumber":274,"sourceCode":"        }\n      } catch (KeyStoreException e) {\n        throw new IOException(\"Problem removing \" + name + \" from \" + this, e);\n      }\n      changed = true;\n    } finally {\n      writeLock.unlock();\n    }\n  }\n\n  CredentialEntry innerSetCredential(String alias, char[] material)\n      throws IOException {\n    writeLock.lock();\n    try {\n      keyStore.setKeyEntry(alias,\n          new SecretKeySpec(new String(material).getBytes(StandardCharsets.UTF_8),\n              getAlgorithm()), password, null);\n    } catch (KeyStoreException e) {\n      throw new IOException(\"Can't store credential \" + alias + \" in \" + this,\n          e);\n    } finally {\n      writeLock.unlock();\n    }\n    changed = true;\n    return new CredentialEntry(alias, material);\n  }\n\n  @Override\n  public void flush() throws IOException {\n    writeLock.lock();\n    try {\n      if (!changed) {\n        LOG.debug(\"Keystore hasn't changed, returning.\");\n        return;\n      }\n      LOG.debug(\"Writing out keystore.\");\n      try (OutputStream out = getOutputStreamForKeystore()) {","sourceCodeStart":256,"sourceCodeEnd":292,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/alias/AbstractJavaKeyStoreProvider.java#L256-L292","documentation":"Thrown by innerSetCredential() when KeyStore.setKeyEntry() rejects the new SecretKeySpec(AES) entry with KeyStoreException. The keystore instance cannot protect/store this kind of key - classically because the store is effectively not a JCEKS store capable of holding secret keys, or its state was not properly initialized for writes.","triggerScenarios":"Writing a credential into a store whose bytes are a JKS (or other type) file that was loaded under the jceks provider path; a .jceks-suffixed file actually created by keytool's default store type; keystore instance left uninitialized after a failed load; JVM provider set that cannot protect AES keys.","commonSituations":"Admin pre-created the file with 'keytool -genkeypair -keystore creds.jceks' (JKS content); mixing keystore tooling between keytool and hadoop credential; FIPS JVMs that disallow the JCEKS key-protection algorithm.","solutions":["Let Hadoop create the store itself: run 'hadoop credential create <alias> -provider jceks://file/<path>' on a clean path so the file is born as JCEKS","If the file came from keytool, re-create it with -storetype jceks, or export/import the secrets into a fresh Hadoop-managed store","Check javax keystore.type/provider overrides in java.security and the JVM's provider list; remove FIPS restrictions or add a provider that supports JCEKS key protection"],"exampleFix":"# before\nkeytool -genkeypair -keystore /etc/hadoop/creds.jceks   # writes JKS-format store\nhadoop credential create s3.key -provider jceks://file/etc/hadoop/creds.jceks   # fails: Can't store credential\n\n# after\nrm /etc/hadoop/creds.jceks\nhadoop credential create s3.key -provider jceks://file/etc/hadoop/creds.jceks   # Hadoop creates a true JCEKS store","handlingStrategy":"validation","validationCode":"// Pre-flight: the existing file must be a loadable JCEKS before writing entries\nstatic boolean isHealthyJceks(Path file, char[] pw) throws Exception {\n  if (!file.toFile().exists() || file.toFile().length() == 0) return true; // will be created fresh\n  KeyStore ks = KeyStore.getInstance(\"jceks\");\n  try (InputStream in = Files.newInputStream(file)) {\n    ks.load(in, pw);\n    return true;\n  } catch (Exception e) {\n    return false;\n  }\n}","typeGuard":null,"tryCatchPattern":"try {\n  provider.createCredentialEntry(alias, material);\n  provider.flush();\n} catch (IOException ex) {\n  if (ex.getCause() instanceof java.security.KeyStoreException) {\n    // store type cannot hold secret keys or is uninitialized:\n    // recreate the file via hadoop credential on a clean path, then retry\n  } else { throw ex; }\n}","preventionTips":["Let 'hadoop credential create' build keystore files; do not pre-create them with keytool defaults","If using keytool, always pass -storetype jceks and never mix certificates into credential stores","Pin one JVM version for all processes that write the store"],"tags":["hadoop","credential-provider","keystore","jceks","store-type","write-failure"],"backgroundTag":"keystore-write-failure","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}