{"record":{"id":"9d69653bc9a84a46","repo":"apache/hadoop","slug":"cannot-find-password-option-key-9d6965","errorCode":null,"errorMessage":"Cannot find password option {key}","messagePattern":"Cannot find password option (.+?)","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"hadoop-tools/hadoop-aws/src/main/java/org/apache/hadoop/fs/s3a/S3AUtils.java","lineNumber":911,"sourceCode":"  }\n\n  /**\n   * Get a password from a configuration/configured credential providers.\n   * @param conf configuration\n   * @param key key to look up\n   * @param defVal value to return if there is no password\n   * @return a password or the value in {@code defVal}\n   * @throws IOException on any problem\n   */\n  static String lookupPassword(Configuration conf, String key, String defVal)\n      throws IOException {\n    try {\n      final char[] pass = conf.getPassword(key);\n      return pass != null ?\n          new String(pass).trim()\n          : defVal;\n    } catch (IOException ioe) {\n      throw new IOException(\"Cannot find password option \" + key, ioe);\n    }\n  }\n\n  /**\n   * String information about a summary entry for debug messages.\n   * @param s3Object s3Object entry\n   * @return string value\n   */\n  public static String stringify(S3Object s3Object) {\n    StringBuilder builder = new StringBuilder(s3Object.key().length() + 100);\n    builder.append(\"\\\"\").append(s3Object.key()).append(\"\\\" \");\n    builder.append(\"size=\").append(s3Object.size());\n    return builder.toString();\n  }\n\n  /**\n   * Get a integer option &gt;= the minimum allowed value.\n   * @param conf configuration","sourceCodeStart":893,"sourceCodeEnd":929,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-tools/hadoop-aws/src/main/java/org/apache/hadoop/fs/s3a/S3AUtils.java#L893-L929","documentation":"IOException thrown by S3AUtils.lookupPassword when Configuration.getPassword(key) itself fails with an IOException. getPassword normally returns null for absent values; an exception means Hadoop could not read the configured credential source - most commonly a hadoop.security.credential.provider.path pointing at a missing, unreadable, or corrupt JCEKS keystore.","triggerScenarios":"Resolving a password-type S3A option (fs.s3a.access.key, fs.s3a.secret.key, fs.s3a.encryption.key, etc.) through a Hadoop CredentialProvider whose store cannot be opened: jceks:// or localjceks:// URL missing, wrong keystore password, corrupt file, or unreachable HDFS path.","commonSituations":"Deploying configs that reference a keystore not shipped to every node; typo'd credential.provider.path or missing file:// scheme; keystore file permissions; migrating configs between clusters; custom keystore password not supplied to processes.","solutions":["Verify the hadoop.security.credential.provider.path entry exists and is readable by the runtime user: hadoop credential list -provider jceks://file:///path/s3.jceks","Fix the URL scheme/typos and confirm the keystore file is deployed on every node that opens the S3A filesystem","Check keystore file permissions and supply the keystore password if the store is protected","Temporarily put the secret in core-site.xml to isolate provider problems from S3 connectivity, then move it back to the keystore"],"exampleFix":"<!-- before: provider path with a missing/mistyped store URL -->\n<property><name>hadoop.security.credential.provider.path</name>\n  <value>jceks://file/opt/hadoop/conf/s3.jceks</value></property>\n\n<!-- after: correct file:// URL to an existing, readable keystore -->\n<property><name>hadoop.security.credential.provider.path</name>\n  <value>jceks://file:///opt/hadoop/conf/s3.jceks</value></property>","handlingStrategy":"validation","validationCode":"String providers = conf.get(\"hadoop.security.credential.provider.path\", \"\");\nfor (String p : providers.split(\",\")) {\n  if (p.startsWith(\"jceks://file:\") || p.startsWith(\"localjceks://file:\")) {\n    String file = p.substring(p.indexOf(\"file:\"));\n    if (!new java.io.File(file).canRead()) {\n      throw new IOException(\"Credential store unreadable: \" + p);\n    }\n  }\n}","typeGuard":null,"tryCatchPattern":"catch IOException whose message starts with 'Cannot find password option' during fs initialization; report the named key and the credential provider path - it is a setup problem, never retryable","preventionTips":["Smoke-test credential stores at deploy time with hadoop credential list -provider ...","Keep provider paths absolute with an explicit file:// scheme","Ship keystore files to every node through configuration management"],"tags":["s3a","hadoop-aws","credentials","credential-provider","jceks","configuration"],"backgroundTag":"credential-store-unreadable","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}