{"record":{"id":"8da8747ca3dac4a3","repo":"apache/hadoop","slug":"credentials-should-not-be-null","errorCode":null,"errorMessage":"Credentials should not be null.","messagePattern":"Credentials should not be null\\.","errorType":"validation","errorClass":"InvalidCredentialsException","httpStatus":null,"severity":"error","filePath":"hadoop-tools/hadoop-aliyun/src/main/java/org/apache/hadoop/fs/aliyun/oss/AliyunCredentialsProvider.java","lineNumber":72,"sourceCode":"\n    if (StringUtils.isEmpty(accessKeyId)\n        || StringUtils.isEmpty(accessKeySecret)) {\n      throw new InvalidCredentialsException(\n          \"AccessKeyId and AccessKeySecret should not be null or empty.\");\n    }\n\n    if (StringUtils.isNotEmpty(securityToken)) {\n      credentials = new DefaultCredentials(accessKeyId, accessKeySecret,\n          securityToken);\n    } else {\n      credentials = new DefaultCredentials(accessKeyId, accessKeySecret);\n    }\n  }\n\n  @Override\n  public void setCredentials(Credentials creds) {\n    if (creds == null) {\n      throw new InvalidCredentialsException(\"Credentials should not be null.\");\n    }\n\n    credentials = creds;\n  }\n\n  @Override\n  public Credentials getCredentials() {\n    if (credentials == null) {\n      throw new InvalidCredentialsException(\"Invalid credentials\");\n    }\n\n    return credentials;\n  }\n}\n","sourceCodeStart":54,"sourceCodeEnd":87,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-tools/hadoop-aliyun/src/main/java/org/apache/hadoop/fs/aliyun/oss/AliyunCredentialsProvider.java#L54-L87","documentation":"Thrown by AliyunCredentialsProvider.setCredentials() when it is called with a null Credentials object. This class implements the Aliyun OSS SDK's CredentialsProvider interface and guards its setter against null so the provider never holds undefined credentials. It is a programming-error guard, not a configuration error: the SDK's ClientConfiguration or client code passed null explicitly.","triggerScenarios":"Calling AliyunCredentialsProvider.setCredentials(null) directly, or wiring this provider into com.aliyun.oss.OSSClientBuilder code that initializes providers with a null Credentials instance before real keys are loaded.","commonSituations":"Custom tooling that refreshes STS session credentials and calls setCredentials with the result of a failed token fetch (null); test code constructing providers without DefaultCredentials; migration from an older OSS SDK whose provider chain tolerated null.","solutions":["Construct a com.aliyun.oss.common.auth.DefaultCredentials(accessKeyId, accessKeySecret) (or with securityToken for STS) and pass that instance instead of null","If refreshing STS tokens, check the token-fetch result for null/empty before calling setCredentials and fail the refresh with a clear error instead","Prefer letting the provider build credentials itself from fs.oss.accessKeyId / fs.oss.accessKeySecret / fs.oss.securityToken configuration rather than setting them externally"],"exampleFix":"// before\nprovider.setCredentials(fetchStsCredentials()); // returns null on failure\n\n// after\nCredentials c = fetchStsCredentials();\nif (c == null || StringUtils.isBlank(c.getAccessKeyId())) {\n  throw new IOException(\"STS credential refresh returned no credentials\");\n}\nprovider.setCredentials(c);","handlingStrategy":"validation","validationCode":"// before calling setCredentials\nif (creds == null) {\n  throw new IllegalArgumentException(\"creds must be built from a successful token fetch\");\n}\nprovider.setCredentials(creds);","typeGuard":null,"tryCatchPattern":"catch (InvalidCredentialsException e) { /* treat as unrecoverable setup bug; fail fast with context */ throw new IllegalStateException(\"Credential provider misuse\", e); }","preventionTips":["Never pass a possibly-null Credentials from token refresh; null-check the fetch result first","Let the provider build credentials from fs.oss.accessKeyId/fs.oss.accessKeySecret instead of manual setCredentials"],"tags":["aliyun-oss","credentials","null-argument","hadoop-connector"],"backgroundTag":"null-credentials-provider","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}