{"record":{"id":"6e7e0b6e6b042758","repo":"apache/hadoop","slug":"invalid-uri-s-account-name-is-not-fully-qualifi","errorCode":null,"errorMessage":"Invalid URI %s - account name is not fully qualified.","messagePattern":"Invalid URI (.+?) - account name is not fully qualified\\.","errorType":"exception","errorClass":"InvalidUriException","httpStatus":null,"severity":"critical","filePath":"hadoop-tools/hadoop-azure/src/main/java/org/apache/hadoop/fs/azurebfs/AzureBlobFileSystemStore.java","lineNumber":1852,"sourceCode":"    try {\n      baseUrl = new URL(url);\n    } catch (MalformedURLException e) {\n      throw new InvalidUriException(uri.toString());\n    }\n\n    SharedKeyCredentials creds = null;\n    AccessTokenProvider tokenProvider = null;\n    SASTokenProvider sasTokenProvider = null;\n\n    if (authType == AuthType.OAuth) {\n      AzureADAuthenticator.init(abfsConfiguration);\n    }\n\n    if (authType == AuthType.SharedKey) {\n      LOG.trace(\"Fetching SharedKey credentials\");\n      int dotIndex = accountName.indexOf(AbfsHttpConstants.DOT);\n      if (dotIndex <= 0) {\n        throw new InvalidUriException(\n                uri.toString() + \" - account name is not fully qualified.\");\n      }\n      creds = new SharedKeyCredentials(accountName.substring(0, dotIndex),\n            abfsConfiguration.getStorageAccountKey());\n    } else if (authType == AuthType.SAS) {\n      LOG.trace(\"Fetching SAS Token Provider\");\n      sasTokenProvider = abfsConfiguration.getSASTokenProvider();\n    } else if (authType == AuthType.UserboundSASWithOAuth) {\n      LOG.trace(\"Fetching SAS and OAuth Token Provider for user bound SAS\");\n      AzureADAuthenticator.init(abfsConfiguration);\n      Object[] providers\n          = abfsConfiguration.getUserBoundSASBothTokenProviders();\n      tokenProvider = (AccessTokenProvider) providers[0];\n      sasTokenProvider = (SASTokenProvider) providers[1];\n      ExtensionHelper.bind(tokenProvider, uri,\n          abfsConfiguration.getRawConfiguration());\n    } else {\n      LOG.trace(\"Fetching token provider\");","sourceCodeStart":1834,"sourceCodeEnd":1870,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-tools/hadoop-azure/src/main/java/org/apache/hadoop/fs/azurebfs/AzureBlobFileSystemStore.java#L1834-L1870","documentation":"With fs.azure.account.auth.type=SharedKey, the store derives the storage account name from the URI authority by taking the substring before the first '.', and signs requests with it. If the authority's account part contains no dot (e.g. abfs://container@myaccount with no domain suffix), SharedKeyCredentials cannot be built and initialization throws InvalidUriException 'account name is not fully qualified'.","triggerScenarios":"Auth type SharedKey plus a fs.defaultFS authority whose account segment lacks a domain suffix; also account-specific key properties (fs.azure.account.key.<authority>) whose name does not echo the fully-qualified account, so no key resolves.","commonSituations":"Switching a mount from OAuth/SAS (which tolerate short names) to SharedKey; Azurite-style configs carried into real cloud; truncated account names in templated core-site.xml.","solutions":["Use the fully qualified account in fs.defaultFS: abfs://container@account.dfs.core.windows.net.","Name the key property to match exactly: fs.azure.account.key.account.dfs.core.windows.net=<base64 key>.","For Azurite keep the fully qualified devstoreaccount1.dfs.core.windows.net authority and point fs.azure.abfs.endpoint at 127.0.0.1.","If short names are mandatory, use OAuth or SAS auth instead - SharedKey requires the domain."],"exampleFix":"<!-- before -->\n<property><name>fs.defaultFS</name><value>abfs://c@myaccount</value></property>\n<property><name>fs.azure.account.auth.type</name><value>SharedKey</value></property>\n\n<!-- after -->\n<property><name>fs.defaultFS</name><value>abfs://c@myaccount.dfs.core.windows.net</value></property>\n<property><name>fs.azure.account.auth.type</name><value>SharedKey</value></property>\n<property><name>fs.azure.account.key.myaccount.dfs.core.windows.net</name><value>BASE64KEY</value></property>","handlingStrategy":"validation","validationCode":"String authority = new URI(fsDefaultFS).getAuthority(); // container@account...\nString account = authority.substring(authority.indexOf('@') + 1);\nif (\"SharedKey\".equals(conf.get(\"fs.azure.account.auth.type\")) && !account.contains(\".\")) {\n  throw new IllegalArgumentException(\"SharedKey requires fully qualified account name, got: \" + account);\n}","typeGuard":null,"tryCatchPattern":"try { fs = FileSystem.get(conf); } catch (InvalidUriException e) { if (e.getMessage().contains(\"not fully qualified\")) { /* add domain suffix to account in fs.defaultFS */ } throw e; }","preventionTips":["Always use account.dfs.core.windows.net in authorities.","Match the fs.azure.account.key.<authority> suffix to the authority exactly.","Remember OAuth/SAS tolerate short names but SharedKey does not."],"tags":["azure","abfs","sharedkey","account-name","authentication","configuration"],"backgroundTag":"invalid-account-name","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}