{"record":{"id":"7360a585a3268008","repo":"apache/hadoop","slug":"s-not-found","errorCode":null,"errorMessage":"'%s' not found","messagePattern":"'(.+?)' not found","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":400,"severity":"error","filePath":"hadoop-common-project/hadoop-kms/src/main/java/org/apache/hadoop/crypto/key/kms/server/KeyAuthorizationKeyProvider.java","lineNumber":255,"sourceCode":"  @Override\n  public EncryptedKeyVersion generateEncryptedKey(String encryptionKeyName)\n      throws IOException, GeneralSecurityException {\n    readLock.lock();\n    try {\n      doAccessCheck(encryptionKeyName, KeyOpType.GENERATE_EEK);\n      return provider.generateEncryptedKey(encryptionKeyName);\n    } finally {\n      readLock.unlock();\n    }\n  }\n\n  private void verifyKeyVersionBelongsToKey(EncryptedKeyVersion ekv)\n      throws IOException {\n    String kn = ekv.getEncryptionKeyName();\n    String kvn = ekv.getEncryptionKeyVersionName();\n    KeyVersion kv = provider.getKeyVersion(kvn);\n    if (kv == null) {\n      throw new IllegalArgumentException(String.format(\n          \"'%s' not found\", kvn));\n    }\n    if (!kv.getName().equals(kn)) {\n      throw new IllegalArgumentException(String.format(\n          \"KeyVersion '%s' does not belong to the key '%s'\", kvn, kn));\n    }\n  }\n\n  @Override\n  public KeyVersion decryptEncryptedKey(EncryptedKeyVersion encryptedKeyVersion)\n          throws IOException, GeneralSecurityException {\n    readLock.lock();\n    try {\n      verifyKeyVersionBelongsToKey(encryptedKeyVersion);\n      doAccessCheck(\n          encryptedKeyVersion.getEncryptionKeyName(), KeyOpType.DECRYPT_EEK);\n      return provider.decryptEncryptedKey(encryptedKeyVersion);\n    } finally {","sourceCodeStart":237,"sourceCodeEnd":273,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-kms/src/main/java/org/apache/hadoop/crypto/key/kms/server/KeyAuthorizationKeyProvider.java#L237-L273","documentation":"KeyAuthorizationKeyProvider.verifyKeyVersionBelongsToKey (line 255) runs during EEK decryption: it looks up the encryption key version name (e.g. mykey@0) in the backing KeyProvider via getKeyVersion. If the provider returns null — no such version exists in the keystore — it throws IllegalArgumentException \"'<versionName>' not found\" (HTTP 400 to REST clients). This is a data/URL integrity check on the EDEK's version reference, not an authorization failure.","triggerScenarios":"POST /v1/keyversion/{versionName}/_eek?eek_op=decrypt where versionName does not exist in the backing keystore: typo'd or truncated version name in the URL, or EEK material produced against a different keystore (e.g. keystore restored from backup, key deleted and recreated, or a dev/test KMS mixup).","commonSituations":"Clients replaying old EDEKs after the key store was wiped/re-created; copy-pasting between environments; version-name formatting mistakes (mykey@0 vs mykey@1); the underlying keystore file replaced underneath the KMS.","solutions":["Verify the version exists: GET /v1/key/{name}/_metadata lists material versions for the key; fix the versionName in the decrypt call","If EDEKs are stale because the keystore was recreated, re-encrypt the data with fresh EEKs (generate again and rewrite)","Make sure each environment (dev/prod) uses its own keystore and clients never send EDEKs across environments"],"exampleFix":"# before\nPOST /v1/keyversion/mykey@9/_eek?eek_op=decrypt\n# after (version that exists per key metadata)\nPOST /v1/keyversion/mykey@0/_eek?eek_op=decrypt","handlingStrategy":"validation","validationCode":"// Before decrypt, confirm the version exists on this provider\nKeyVersion kv = provider.getKeyVersion(ekv.getEncryptionKeyVersionName());\nif (kv == null) throw new IllegalStateException(\"stale EDEK: version no longer in keystore, re-encrypt data\");","typeGuard":null,"tryCatchPattern":"try { provider.decryptEncryptedKey(ekv); } catch (IllegalArgumentException e) { if (e.getMessage().endsWith(\"not found\")) { /* stale/foreign version: re-encrypt path */ } else throw e; }","preventionTips":["Never reuse EDEKs across keystore re-creations or environments","Persist key name + version name + IV + material as one EDEK record","After restoring a keystore from backup, plan a re-encryption pass for affected data"],"tags":["hadoop-kms","key-version","http-400","data-integrity","key-management"],"backgroundTag":"referenced-entity-not-found","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}