{"record":{"id":"699d2a651bf53922","repo":"apache/hadoop","slug":"the-keystore-password-parameter-is-empty-for-the-z","errorCode":null,"errorMessage":"The keystore password parameter is empty for the ZooKeeper client connection.","messagePattern":"The keystore password parameter is empty for the ZooKeeper client connection\\.","errorType":"exception","errorClass":"ConfigurationException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/SecurityUtil.java","lineNumber":860,"sourceCode":"      if (zkAuthConf != null) {\n        return ZKUtil.parseAuth(zkAuthConf);\n      } else {\n        return Collections.emptyList();\n      }\n    } catch (IOException | ZKUtil.BadAuthFormatException e) {\n      LOG.error(\"Couldn't read Auth based on {}\", configKey);\n      throw e;\n    }\n  }\n\n  public static void validateSslConfiguration(TruststoreKeystore truststoreKeystore)\n          throws ConfigurationException {\n    if (org.apache.commons.lang3.StringUtils.isEmpty(truststoreKeystore.keystoreLocation)) {\n      throw new ConfigurationException(\n          \"The keystore location parameter is empty for the ZooKeeper client connection.\");\n    }\n    if (org.apache.commons.lang3.StringUtils.isEmpty(truststoreKeystore.keystorePassword)) {\n      throw new ConfigurationException(\n          \"The keystore password parameter is empty for the ZooKeeper client connection.\");\n    }\n    if (org.apache.commons.lang3.StringUtils.isEmpty(truststoreKeystore.truststoreLocation)) {\n      throw new ConfigurationException(\n          \"The truststore location parameter is empty for the ZooKeeper client connection.\");\n    }\n    if (org.apache.commons.lang3.StringUtils.isEmpty(truststoreKeystore.truststorePassword)) {\n      throw new ConfigurationException(\n          \"The truststore password parameter is empty for the ZooKeeper client connection.\");\n    }\n  }\n\n  /**\n   * Configure ZooKeeper Client with SSL/TLS connection.\n   * @param zkClientConfig ZooKeeper Client configuration\n   * @param truststoreKeystore truststore keystore, that we use to set the SSL configurations\n   * @throws ConfigurationException if the SSL configs are empty\n   */","sourceCodeStart":842,"sourceCodeEnd":878,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/SecurityUtil.java#L842-L878","documentation":"The second check in SecurityUtil.validateSslConfiguration: after confirming the keystore location, it requires a non-empty keystore password (StringUtils.isEmpty rejects null and blank). A blank keystore password means the client cannot open its own key material for mutual TLS, so ConfigurationException is thrown.","triggerScenarios":"ZK SSL configured with a keystore location but the keystore password property is unset or empty, e.g. the password was expected from a credential provider that failed to resolve, leaving the field blank in the TruststoreKeystore.","commonSituations":"Passwords migrated to CredentialProvider/Hadoop KeyStore but the alias lookup returns nothing; passwords omitted in templated configs; values containing only whitespace.","solutions":["Set the zookeeper SSL keystore password property (zookeeper.ssl.keystore.password) to the keystore password","If using a credential provider, verify the alias resolves: hadoop credential list -provider <path>","Ensure the property name matches exactly and has no trailing whitespace-only value","Keep file permissions on the config/keystore tight since it now holds a secret"],"exampleFix":"# before\nhadoop credential create zookeeper.ssl.keystore.password -value '' -provider localjceks://file/etc/zk/ssl/creds.jceks\n\n# after\nhadoop credential create zookeeper.ssl.keystore.password -value '<real-password>' -provider localjceks://file/etc/zk/ssl/creds.jceks","handlingStrategy":"validation","validationCode":"String pw = conf.get(\"zookeeper.ssl.keystore.password\");\nif (org.apache.commons.lang3.StringUtils.isEmpty(pw)) {\n  throw new ConfigurationException(\n      \"zookeeper.ssl.keystore.password is required when keystore.location is set\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Resolve credential-provider aliases during deploy and fail on empty values","Never assume a blank password works because the keystore was created without one","Log (never print) resolved booleans for each SSL secret at startup"],"tags":["ssl","tls","zookeeper","configuration","password"],"backgroundTag":"incomplete-ssl-configuration","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}