{"record":{"id":"59054d663c44977c","repo":"apache/iceberg","slug":"failed-to-get-application-default-credentials","errorCode":null,"errorMessage":"Failed to get application default credentials","messagePattern":"Failed to get application default credentials","errorType":"exception","errorClass":"UncheckedIOException","httpStatus":null,"severity":"error","filePath":"bigquery/src/main/java/org/apache/iceberg/gcp/bigquery/BigQueryProperties.java","lineNumber":173,"sourceCode":"    } else {\n      builder.setCredentials(buildApplicationDefaultCredentials());\n    }\n\n    return builder.build();\n  }\n\n  private GoogleCredentials buildApplicationDefaultCredentials() {\n    try {\n      GoogleCredentials applicationDefaultCredentials =\n          GoogleCredentials.getApplicationDefault().createScoped(BigqueryScopes.all());\n\n      LOG.debug(\n          \"Created application default credentials for BigQuery: {}\",\n          applicationDefaultCredentials);\n\n      return applicationDefaultCredentials;\n    } catch (IOException e) {\n      throw new UncheckedIOException(\"Failed to get application default credentials\", e);\n    }\n  }\n\n  private ImpersonatedCredentials buildImpersonatedCredentials() {\n    try {\n      GoogleCredentials sourceCredentials = GoogleCredentials.getApplicationDefault();\n\n      ImpersonatedCredentials impersonatedCredentials =\n          ImpersonatedCredentials.create(\n              sourceCredentials, impersonateServiceAccount, delegates, scopes, lifetimeSeconds);\n\n      // refresh to validate credentials and get initial token\n      impersonatedCredentials.refresh();\n\n      LOG.debug(\n          \"Created impersonated credentials for BigQuery: Target={}\", impersonateServiceAccount);\n\n      return impersonatedCredentials;","sourceCodeStart":155,"sourceCodeEnd":191,"githubUrl":"https://github.com/apache/iceberg/blob/86d9c8fc543e7c56c9f624eb725f76c9baff9570/bigquery/src/main/java/org/apache/iceberg/gcp/bigquery/BigQueryProperties.java#L155-L191","documentation":"BigQueryProperties.buildApplicationDefaultCredentials wraps the IOException thrown by GoogleCredentials.getApplicationDefault() in an UncheckedIOException when Application Default Credentials (ADC) cannot be resolved. ADC requires a well-known gcloud credentials file, GOOGLE_APPLICATION_CREDENTIALS pointing at a service-account key, or a metadata server (e.g. GCE/GKE). This library throws it because the BigQuery Metastore catalog cannot authenticate without credentials.","triggerScenarios":"Calling metastoreOptions (which builds the BigQuery client) on a machine with no ADC available: no gcloud user login, GOOGLE_APPLICATION_CREDENTIALS unset or pointing to a missing/invalid file, and no GCE metadata server.","commonSituations":"Running Spark/Flink jobs locally without `gcloud auth application-default login`; deploying outside GCP without mounting a service-account key; GOOGLE_APPLICATION_CREDENTIALS typo'd or the JSON key file deleted; running in non-GCP CI containers.","solutions":["Run `gcloud auth application-default login` on the local machine, or set GOOGLE_APPLICATION_CREDENTIALS to a valid service-account JSON key path.","If running on GCP, ensure the workload runs on GCE/GKE/Cloud Run with a service account attached so the metadata server supplies credentials.","Verify the credentials file exists, is readable, and is valid JSON with the expected service-account fields.","Pass credentials explicitly via the BigQueryProperties/GCP configuration the catalog supports instead of relying on ADC."],"exampleFix":"// before\nBigMQCatalog.create(...); // no credentials configured\n// after\n$ gcloud auth application-default login\n# or\nexport GOOGLE_APPLICATION_CREDENTIALS=/path/to/service-account.json","handlingStrategy":"validation","validationCode":"import com.google.auth.oauth2.GoogleCredentials;\nboolean adcAvailable;\ntry {\n  GoogleCredentials.getApplicationDefault().refreshIfExpired();\n  adcAvailable = true;\n} catch (IOException e) {\n  adcAvailable = false;\n}\nif (!adcAvailable) throw new IllegalStateException(\"Set GOOGLE_APPLICATION_CREDENTIALS or run 'gcloud auth application-default login' before creating the BigQuery catalog\");","typeGuard":null,"tryCatchPattern":"try {\n  catalog = BigQueryCatalog.create(...);\n} catch (UncheckedIOException e) {\n  throw new IllegalStateException(\"ADC unavailable: \" + e.getCause().getMessage(), e);\n}","preventionTips":["Always set GOOGLE_APPLICATION_CREDENTIALS or run `gcloud auth application-default login` before local/dev runs","Attach a service account to GCE/GKE/Cloud Run workloads so ADC resolves via metadata server","Validate credentials at job startup, not deep inside the first commit","Keep the service-account key file path in one place and verify readability in startup checks"],"tags":["gcp","authentication","bigquery","credentials"],"backgroundTag":"missing-credentials","analyzedSha":"86d9c8fc543e7c56c9f624eb725f76c9baff9570","analyzedAt":"2026-09-12T00:46:39.097Z","contentChangedAt":"2026-09-12T00:46:39.097Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}