{"record":{"id":"52d1a5f7c3ea4db9","repo":"apache/hadoop","slug":"encryptioncontext-not-present-in-getpathstatus-res","errorCode":null,"errorMessage":"EncryptionContext not present in GetPathStatus response","messagePattern":"EncryptionContext not present in GetPathStatus response","errorType":"exception","errorClass":"PathIOException","httpStatus":null,"severity":"error","filePath":"hadoop-tools/hadoop-azure/src/main/java/org/apache/hadoop/fs/azurebfs/AzureBlobFileSystemStore.java","lineNumber":603,"sourceCode":"   *     {@link NoContextEncryptionAdapter}: if encryptionType is not of type\n   *     {@link org.apache.hadoop.fs.azurebfs.utils.EncryptionType#ENCRYPTION_CONTEXT}.\n   *   </li>\n   *   <li>\n   *     new object of {@link ContextProviderEncryptionAdapter} containing required encryptionKeys for the give file:\n   *     if encryptionType is of type {@link org.apache.hadoop.fs.azurebfs.utils.EncryptionType#ENCRYPTION_CONTEXT}.\n   *   </li>\n   * </ul>\n   */\n  private ContextEncryptionAdapter createEncryptionAdapterFromServerStoreContext(final String path,\n      final TracingContext tracingContext) throws IOException {\n    if (getClient().getEncryptionType() != EncryptionType.ENCRYPTION_CONTEXT) {\n      return NoContextEncryptionAdapter.getInstance();\n    }\n    final String responseHeaderEncryptionContext = getClient().getPathStatus(path,\n            false, tracingContext, null).getResult()\n        .getResponseHeader(X_MS_ENCRYPTION_CONTEXT);\n    if (responseHeaderEncryptionContext == null) {\n      throw new PathIOException(path,\n          \"EncryptionContext not present in GetPathStatus response\");\n    }\n    byte[] encryptionContext = responseHeaderEncryptionContext.getBytes(\n        StandardCharsets.UTF_8);\n\n    try {\n      return new ContextProviderEncryptionAdapter(getClient().getEncryptionContextProvider(),\n          new Path(path).toUri().getPath(), encryptionContext);\n    } catch (IOException e) {\n      LOG.debug(\"Could not initialize EncryptionAdapter\");\n      throw e;\n    }\n  }\n\n  public void setPathProperties(final Path path,\n      final Hashtable<String, String> properties, TracingContext tracingContext)\n      throws IOException {\n    try (AbfsPerfInfo perfInfo = startTracking(\"setPathProperties\", \"setPathProperties\")){","sourceCodeStart":585,"sourceCodeEnd":621,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-tools/hadoop-azure/src/main/java/org/apache/hadoop/fs/azurebfs/AzureBlobFileSystemStore.java#L585-L621","documentation":"The ABFS driver is configured for client-side encryption via an encryption-context provider (fs.azure.encryption.context.provider.type, EncryptionType.ENCRYPTION_CONTEXT). In this mode every file must carry its per-file encryption context, returned by the service in the x-ms-encryption-context response header of GetPathStatus. createEncryptionAdapterFromServerStoreContext builds the decrypting adapter for a path; when that header is null it throws PathIOException, meaning the file at this path was not written with an encryption context.","triggerScenarios":"Any operation that resolves the server-side encryption context for a path (e.g. append/overwrite setup, reads that go through createEncryptionAdapterFromServerStoreContext) while the provider is configured, and the GetPathStatus response for that path lacks x-ms-encryption-context.","commonSituations":"Enabling fs.azure.encryption.context.provider.type on data written before the setting existed; files uploaded out-of-band through Azure Portal, az cli, or the Storage SDK (which never set x-ms-encryption-context); provider pointed at the wrong account/filesystem.","solutions":["Verify the file was created through the ABFS Hadoop client while the encryption-context provider was configured; externally uploaded files will not have the header.","Re-create or copy the file through the ABFS filesystem with the provider active so x-ms-encryption-context is written.","Confirm the header exists with a raw call: 'az storage fs file show -f <fs> -p <path> --query properties.metadata' or a REST GetPathStatus with header inspection.","For legacy unencrypted data, mount it through a separate filesystem config without the provider; mixing modes on one mount will keep failing."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  fs.open(path);\n} catch (PathIOException e) {\n  if (e.getMessage().contains(\"EncryptionContext not present\")) {\n    // file predates encryption-context enablement: rewrite via ABFS or use an unencrypted mount\n  }\n}","preventionTips":["Enable fs.azure.encryption.context.provider.type before any data is written, not after.","Land external data through the encrypted ABFS mount, not AzCopy/SDK directly.","Keep legacy unencrypted data on a separate mount without the provider."],"tags":["azure","abfs","encryption","client-side-encryption","http-header"],"backgroundTag":"encryption-context-missing","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}