{"record":{"id":"53e778f9c3eabe5c","repo":"t8y2/dbx","slug":"hive-storepasswordpath-uses-the-java-hadoop-creden-53e778","errorCode":null,"errorMessage":"Hive storePasswordPath uses the Java Hadoop credential-provider format; configure trustStorePassword explicitly for the native agent","messagePattern":"Hive storePasswordPath uses the Java Hadoop credential-provider format; configure trustStorePassword explicitly for the native agent","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/hive-go/config.go","lineNumber":1068,"sourceCode":"\tif parameterBool(values, \"sslinsecureskipverify\") || parameterBool(values, \"allowselfsigned\") {\n\t\tconfig.InsecureSkipVerify = true\n\t}\n\tvar customRoots *x509.CertPool\n\tcredentialProviderPath := parameter(values, \"storepasswordpath\")\n\tif path := strings.TrimSpace(params.CACertPath); path != \"\" {\n\t\tcontents, err := os.ReadFile(path)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"read Hive CA certificate: %w\", err)\n\t\t}\n\t\tcustomRoots = x509.NewCertPool()\n\t\tif !customRoots.AppendCertsFromPEM(contents) {\n\t\t\treturn nil, errors.New(\"Hive CA certificate contains no certificates\")\n\t\t}\n\t}\n\ttrustStoreLocation := parameter(values, \"ssltruststore\")\n\tif trustStoreLocation != \"\" {\n\t\tif parameter(values, \"truststorepassword\") == \"\" && credentialProviderPath != \"\" {\n\t\t\treturn nil, errors.New(\"Hive storePasswordPath uses the Java Hadoop credential-provider format; configure trustStorePassword explicitly for the native agent\")\n\t\t}\n\t\tcertificates, err := loadTrustStore(\n\t\t\ttrustStoreLocation,\n\t\t\tparameter(values, \"truststorepassword\"),\n\t\t\tparameter(values, \"truststoretype\"),\n\t\t)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"load Hive truststore: %w\", err)\n\t\t}\n\t\tif customRoots == nil {\n\t\t\tcustomRoots = x509.NewCertPool()\n\t\t}\n\t\tfor _, certificate := range certificates {\n\t\t\tcustomRoots.AddCert(certificate)\n\t\t}\n\t}\n\tconfig.RootCAs = customRoots\n\tif params.ClientCertPath != \"\" || params.ClientKeyPath != \"\" {","sourceCodeStart":1050,"sourceCodeEnd":1086,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/hive-go/config.go#L1050-L1086","documentation":"When sslTrustStore is configured and no explicit trustStorePassword parameter is present, the driver checks whether a Java Hadoop credential-provider path (storePasswordPath) was supplied. Since the native Go agent cannot read the Java credential-provider JCEKS format, it rejects the config and asks the user to provide the trust store password directly.","triggerScenarios":"A config with sslTrustStore set, no truststorepassword parameter, and a credential-provider style storePasswordPath value (e.g. jceks://hdfs/path or the Hadoop provider syntax) carried over from a JDBC/Hive Java client URL.","commonSituations":"Migrating Java Hive JDBC connection strings (with credentialProvider/hadoop-credential store passwords) to the native Go agent; copying enterprise connection settings verbatim from DBeaver/JDBC configs.","solutions":["Set the truststorepassword parameter explicitly in the connection parameters.","Remove the Java credential-provider storePasswordPath setting; extract the password from the JCEKS provider once and configure it plainly.","Load the trust store into PEM form (sslCACertificate) to bypass Java keystores entirely."],"exampleFix":"// before\n// sslTrustStore=/etc/certs/truststore.jks, storePasswordPath=jceks://hdfs/secrets/pass\n// after\n// sslTrustStore=/etc/certs/truststore.jks, trustStorePassword=changeit","handlingStrategy":"validation","validationCode":"if params[\"ssltruststore\"] != \"\" && params[\"truststorepassword\"] == \"\" &&\n\tstrings.HasPrefix(params[\"storepasswordpath\"], \"jceks://\") {\n\treturn fmt.Errorf(\"native agent needs an explicit trustStorePassword, not a Hadoop credential provider\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Audit migrated JDBC URLs and strip credentialProvider/storePasswordPath options","Inject store passwords as environment variables or secret files, not Java credential providers","Document that the Go agent reads no JCEKS files"],"tags":["tls","keystore","config","migration"],"backgroundTag":"java-credential-provider-unsupported","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}