{"record":{"id":"93e1e1fcd7a7db7a","repo":"apache/hadoop","slug":"problem-removing-name-from-this-93e1e1","errorCode":null,"errorMessage":"Problem removing \" + name + \" from \" + this","messagePattern":"Problem removing \" \\+ name \\+ \" from \" \\+ this","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/alias/AbstractJavaKeyStoreProvider.java","lineNumber":258,"sourceCode":"          + this, e);\n    } finally {\n      writeLock.unlock();\n    }\n  }\n\n  @Override\n  public void deleteCredentialEntry(String name) throws IOException {\n    writeLock.lock();\n    try {\n      try {\n        if (keyStore.containsAlias(name)) {\n          keyStore.deleteEntry(name);\n        } else {\n          throw new IOException(\"Credential \" + name + \" does not exist in \"\n              + this);\n        }\n      } catch (KeyStoreException e) {\n        throw new IOException(\"Problem removing \" + name + \" from \" + this, e);\n      }\n      changed = true;\n    } finally {\n      writeLock.unlock();\n    }\n  }\n\n  CredentialEntry innerSetCredential(String alias, char[] material)\n      throws IOException {\n    writeLock.lock();\n    try {\n      keyStore.setKeyEntry(alias,\n          new SecretKeySpec(new String(material).getBytes(StandardCharsets.UTF_8),\n              getAlgorithm()), password, null);\n    } catch (KeyStoreException e) {\n      throw new IOException(\"Can't store credential \" + alias + \" in \" + this,\n          e);\n    } finally {","sourceCodeStart":240,"sourceCodeEnd":276,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/alias/AbstractJavaKeyStoreProvider.java#L240-L276","documentation":"Thrown by deleteCredentialEntry() when KeyStore.deleteEntry(name) fails with KeyStoreException after the existence check passed. The keystore handle went bad between containsAlias() and deleteEntry() - typically an uninitialized/inconsistent KeyStore instance or an entry the provider cannot manipulate.","triggerScenarios":"Concurrent modification of the keystore between check and delete; store loaded partially or of a type this JVM cannot fully handle; entry added by an external tool with attributes JCEKS cannot process.","commonSituations":"Two processes writing the same .jceks simultaneously (the file-level locking is not cross-process); keystore edited by keytool with a different store type while Hadoop holds it.","solutions":["Serialize writers: run only one hadoop credential/admin process against a keystore at a time","Verify the store with keytool -list -keystore <file> -storetype jceks and re-create if damaged","Retry the delete once after re-instantiating the provider (fresh URI + Configuration)"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  provider.deleteCredentialEntry(name);\n} catch (IOException ex) {\n  if (ex.getCause() instanceof java.security.KeyStoreException) {\n    // rebuild provider from fresh Configuration and retry the delete exactly once;\n    // persistent failure => store corrupt, restore from backup\n  } else { throw ex; }\n}","preventionTips":["Serialize all mutations of a keystore file through a single process or an admin host","Take a file-level backup (cp) before scripted bulk deletes"],"tags":["hadoop","credential-provider","keystore","delete-entry","jceks"],"backgroundTag":"keystore-unavailable","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}