{"record":{"id":"8edb6974ce22fd1a","repo":"t8y2/dbx","slug":"hive-storepasswordpath-uses-the-java-hadoop-creden-8edb69","errorCode":null,"errorMessage":"Hive storePasswordPath uses the Java Hadoop credential-provider format; configure keyStorePassword explicitly for the native agent","messagePattern":"Hive storePasswordPath uses the Java Hadoop credential-provider format; configure keyStorePassword explicitly for the native agent","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/argo-go/config.go","lineNumber":1096,"sourceCode":"\t\tfor _, certificate := range certificates {\n\t\t\tcustomRoots.AddCert(certificate)\n\t\t}\n\t}\n\tconfig.RootCAs = customRoots\n\tif params.ClientCertPath != \"\" || params.ClientKeyPath != \"\" {\n\t\tif params.ClientCertPath == \"\" || params.ClientKeyPath == \"\" {\n\t\t\treturn nil, errors.New(\"Hive client certificate and key must be configured together\")\n\t\t}\n\t\tcertificate, err := tls.LoadX509KeyPair(params.ClientCertPath, params.ClientKeyPath)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"load Hive client certificate: %w\", err)\n\t\t}\n\t\tconfig.Certificates = []tls.Certificate{certificate}\n\t}\n\tkeyStoreLocation := parameter(values, \"sslkeystore\")\n\tif keyStoreLocation != \"\" {\n\t\tif parameter(values, \"keystorepassword\") == \"\" && credentialProviderPath != \"\" {\n\t\t\treturn nil, errors.New(\"Hive storePasswordPath uses the Java Hadoop credential-provider format; configure keyStorePassword explicitly for the native agent\")\n\t\t}\n\t\tcertificate, err := loadClientKeyStore(\n\t\t\tkeyStoreLocation,\n\t\t\tparameter(values, \"keystorepassword\"),\n\t\t\tparameter(values, \"keystoretype\"),\n\t\t)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"load Hive keystore: %w\", err)\n\t\t}\n\t\tconfig.Certificates = append(config.Certificates, certificate)\n\t}\n\tif parameterBool(values, \"twoway\") {\n\t\tif keyStoreLocation == \"\" && len(config.Certificates) == 0 {\n\t\t\treturn nil, errors.New(\"Hive two-way TLS requires sslKeyStore or a client certificate\")\n\t\t}\n\t\tif trustStoreLocation == \"\" && config.RootCAs == nil {\n\t\t\treturn nil, errors.New(\"Hive two-way TLS requires sslTrustStore or a CA certificate\")\n\t\t}","sourceCodeStart":1078,"sourceCodeEnd":1114,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/argo-go/config.go#L1078-L1114","documentation":"Analogous to the truststore case but for the client keystore: when sslkeystore is set, keystorepassword is empty, and credentialProviderPath is set, the native agent cannot resolve the key-store password from the Java Hadoop credential provider and rejects the config, asking for an explicit keyStorePassword. The Go agent cannot decrypt PKCS12/JKS keystores without the password.","triggerScenarios":"Configuring the Hive driver with sslkeystore non-empty, keystorepassword empty, while relying on credentialProviderPath (JCEKS credential provider) to supply the keystore password.","commonSituations":"Migration from the Java Hive JDBC driver where the keystore password lived in a Hadoop credential provider; CI/CD templating wrote sslkeystore but omitted keystorepassword; typo in the keystorepassword parameter key leaving it empty at lookup time.","solutions":["Set keystorepassword explicitly to the client keystore password.","Extract the password from the credential provider (hadoop credential get <alias>) and inject it via environment/config, then remove reliance on credentialProviderPath for this agent.","Verify the parameter key is exactly keystorepassword (lowercase) so the lookup does not return empty.","Convert the client key/cert to PEM files and use clientCertPath/clientKeyPath instead of a password-protected keystore."],"exampleFix":"// before\nvalues[\"sslkeystore\"] = \"/etc/hive/conf/client.keystore.p12\"\n// password expected from credentialProviderPath (JCEKS)\n// after\nvalues[\"sslkeystore\"] = \"/etc/hive/conf/client.keystore.p12\"\nvalues[\"keystorepassword\"] = os.Getenv(\"HIVE_KEYSTORE_PASSWORD\")","handlingStrategy":"validation","validationCode":"if values[\"sslkeystore\"] != \"\" && values[\"keystorepassword\"] == \"\" && credentialProviderPath != \"\" {\n\treturn errors.New(\"keyStorePassword must be set explicitly for the native agent\")\n}","typeGuard":"func keystoreReady(values map[string]string, credPath string) bool {\n\treturn values[\"sslkeystore\"] == \"\" || values[\"keystorepassword\"] != \"\"\n}","tryCatchPattern":"cfg, err := buildConfig(values, credentialProviderPath)\nif err != nil {\n\tif strings.Contains(err.Error(), \"configure keyStorePassword explicitly\") {\n\t\treturn fmt.Errorf(\"resolve keystore password from JCEKS and set keystorepassword: %w\", err)\n\t}\n\treturn err\n}","preventionTips":["Resolve Hadoop credential-provider passwords at deploy time into env vars.","Keep parameter keys lowercase and exact: keystorepassword, keystoretype.","Consider converting the client keystore to PEM cert+key files to eliminate passwords entirely.","Add a config lint step that pairs sslkeystore/keystorepassword presence in CI."],"tags":["tls","hive","keystore","credential-provider"],"backgroundTag":"credential-provider-not-supported","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}