{"record":{"id":"8f3dcc0df8943662","repo":"apache/hadoop","slug":"the-keystore-location-parameter-is-empty-for-the-z","errorCode":null,"errorMessage":"The keystore location parameter is empty for the ZooKeeper client connection.","messagePattern":"The keystore location parameter is empty for the ZooKeeper client connection\\.","errorType":"exception","errorClass":"ConfigurationException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/SecurityUtil.java","lineNumber":856,"sourceCode":"    String zkAuthConf =\n        zkAuthChars != null ? String.valueOf(zkAuthChars) : null;\n    try {\n      zkAuthConf = ZKUtil.resolveConfIndirection(zkAuthConf);\n      if (zkAuthConf != null) {\n        return ZKUtil.parseAuth(zkAuthConf);\n      } else {\n        return Collections.emptyList();\n      }\n    } catch (IOException | ZKUtil.BadAuthFormatException e) {\n      LOG.error(\"Couldn't read Auth based on {}\", configKey);\n      throw e;\n    }\n  }\n\n  public static void validateSslConfiguration(TruststoreKeystore truststoreKeystore)\n          throws ConfigurationException {\n    if (org.apache.commons.lang3.StringUtils.isEmpty(truststoreKeystore.keystoreLocation)) {\n      throw new ConfigurationException(\n          \"The keystore location parameter is empty for the ZooKeeper client connection.\");\n    }\n    if (org.apache.commons.lang3.StringUtils.isEmpty(truststoreKeystore.keystorePassword)) {\n      throw new ConfigurationException(\n          \"The keystore password parameter is empty for the ZooKeeper client connection.\");\n    }\n    if (org.apache.commons.lang3.StringUtils.isEmpty(truststoreKeystore.truststoreLocation)) {\n      throw new ConfigurationException(\n          \"The truststore location parameter is empty for the ZooKeeper client connection.\");\n    }\n    if (org.apache.commons.lang3.StringUtils.isEmpty(truststoreKeystore.truststorePassword)) {\n      throw new ConfigurationException(\n          \"The truststore password parameter is empty for the ZooKeeper client connection.\");\n    }\n  }\n\n  /**\n   * Configure ZooKeeper Client with SSL/TLS connection.","sourceCodeStart":838,"sourceCodeEnd":874,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/SecurityUtil.java#L838-L874","documentation":"SecurityUtil.validateSslConfiguration checks a TruststoreKeystore built from the ZooKeeper client SSL properties. If the keystore location is blank (StringUtils.isEmpty), a ConfigurationException is thrown; keystore password, truststore location and truststore password are validated immediately after. The checks enforce that mutual TLS for the ZK client is configured completely, not partially.","triggerScenarios":"Enabling ZooKeeper TLS (e.g. a secure ZKResourceManager state store) where the keystore location property never reached the TruststoreKeystore, so validateSslConfiguration fails during setSslConfiguration before the ZK connection opens.","commonSituations":"Partial SSL migration where truststore settings were filled but the keystore was omitted; property-name typos so the location never lands in the object; configs managed per-role and the daemon's file missing the key.","solutions":["Set the zookeeper SSL keystore location property (zookeeper.ssl.keystore.location) to the keystore file path","Re-check exact property names against the code that builds TruststoreKeystore","Fill the other three fields too: keystore password, truststore location, truststore password","Restart the daemon and confirm the four values appear in the effective configuration dump"],"exampleFix":"<!-- before: keystore omitted -->\n<property><name>zookeeper.ssl.truststore.location</name><value>/etc/zk/ssl/truststore.jks</value></property>\n\n<!-- after -->\n<property><name>zookeeper.ssl.keystore.location</name><value>/etc/zk/ssl/keystore.jks</value></property>\n<property><name>zookeeper.ssl.truststore.location</name><value>/etc/zk/ssl/truststore.jks</value></property>","handlingStrategy":"validation","validationCode":"TruststoreKeystore ts = buildFromConf(conf);\nif (org.apache.commons.lang3.StringUtils.isEmpty(ts.keystoreLocation)) {\n  throw new ConfigurationException(\n      \"zookeeper.ssl.keystore.location is required for secure ZK connections\");\n}\nSecurityUtil.validateSslConfiguration(ts);","typeGuard":"static boolean sslConfigComplete(SecurityUtil.TruststoreKeystore ts) {\n  return StringUtils.isNoneEmpty(ts.keystoreLocation, ts.keystorePassword,\n      ts.truststoreLocation, ts.truststorePassword);\n}","tryCatchPattern":null,"preventionTips":["Check all four SSL fields in one place before opening the ZK connection","Add config linter rules for zookeeper.ssl.* keys","Test secure ZK connections in CI with realistic keystores"],"tags":["ssl","tls","zookeeper","configuration","keystore"],"backgroundTag":"incomplete-ssl-configuration","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}