{"record":{"id":"9e77e6edc4095289","repo":"pentaho/pentaho-kettle","slug":"symmetriccryptotrans-exception-secretkeymissing","errorCode":"SymmetricCryptoTrans.Exception.SecretKeyMissing","errorMessage":"SymmetricCryptoTrans.Exception.SecretKeyMissing","messagePattern":"SymmetricCryptoTrans\\.Exception\\.SecretKeyMissing","errorType":"exception","errorClass":"KettleStepException","httpStatus":null,"severity":"error","filePath":"engine/src/main/java/org/pentaho/di/trans/steps/symmetriccrypto/symmetriccryptotrans/SymmetricCryptoTrans.java","lineNumber":99,"sourceCode":"        // Message Field is missing !\n        throw new KettleStepException( BaseMessages.getString(\n          PKG, \"SymmetricCryptoTrans.Exception.MissingMessageField\" ) );\n      }\n      // Try to get Field index\n      data.indexOfMessage = getInputRowMeta().indexOfValue( meta.getMessageFied() );\n\n      // Let's check the Field\n      if ( data.indexOfMessage < 0 ) {\n        // The field is unreachable !\n        throw new KettleStepException( BaseMessages.getString(\n          PKG, \"SymmetricCryptoTrans.Exception.CouldnotFindField\", meta.getMessageFied() ) );\n      }\n\n      if ( !meta.isSecretKeyInField() ) {\n        String realSecretKey =\n          Encr.decryptPasswordOptionallyEncrypted( environmentSubstitute( meta.getSecretKey() ) );\n        if ( Utils.isEmpty( realSecretKey ) ) {\n          throw new KettleStepException( BaseMessages.getString(\n            PKG, \"SymmetricCryptoTrans.Exception.SecretKeyMissing\" ) );\n        }\n        // We have a static secret key\n        // Set secrete key\n        setSecretKey( realSecretKey );\n\n      } else {\n        // dynamic secret key\n        if ( Utils.isEmpty( meta.getSecretKeyField() ) ) {\n          throw new KettleStepException( BaseMessages.getString(\n            PKG, \"SymmetricCryptoTrans.Exception.SecretKeyFieldMissing\" ) );\n        }\n        // Try to get secret key field index\n        data.indexOfSecretkeyField = getInputRowMeta().indexOfValue( meta.getSecretKeyField() );\n\n        // Let's check the Field\n        if ( data.indexOfSecretkeyField < 0 ) {\n          // The field is unreachable !","sourceCodeStart":81,"sourceCodeEnd":117,"githubUrl":"https://github.com/pentaho/pentaho-kettle/blob/f3058517a153da500bf4551f46d79b91bf8ec552/engine/src/main/java/org/pentaho/di/trans/steps/symmetriccrypto/symmetriccryptotrans/SymmetricCryptoTrans.java#L81-L117","documentation":"When the secret key is supplied statically (secretKeyInField = false), the step decrypts/interpolates meta.getSecretKey() via Encr.decryptPasswordOptionallyEncrypted(environmentSubstitute(...)) and throws this KettleStepException if the resulting key is empty. Without a key the crypto operation is impossible, so the step fails at startup.","triggerScenarios":"Static key mode selected but the 'Secret key' box is empty; the key references an environment variable/Kettle variable that is undefined or empty at runtime, so environmentSubstitute() resolves to an empty string.","commonSituations":"Deploying a transformation to a server where ${SECRET_KEY} or an internal Kettle variable isn't defined; user typed the key in one environment but used variables; key cleared accidentally in the dialog.","solutions":["Enter the secret key directly in the step dialog's 'Secret key' field, or","Define the referenced Kettle/environment variable (e.g. -DSECRET_KEY=... or via kettle.properties / setEnvironmentVariable) before running.","Check for typos in the ${VAR} placeholder — an unresolved-but-present variable that resolves empty still triggers this.","If the key should come from the data stream instead, enable 'secret key in field' and set the key field."],"exampleFix":"// before\nmeta.setSecretKey(\"${SYMM_KEY}\"); // SYMM_KEY not defined at runtime\n// after\ntransMeta.setVariable(\"SYMM_KEY\", System.getenv(\"SYMM_KEY\"));\nmeta.setSecretKey(\"${SYMM_KEY}\");","handlingStrategy":"validation","validationCode":"String key = transMeta.getVariable(\"SYMM_KEY\");\nif (key == null || key.isEmpty()) {\n  throw new IllegalStateException(\"Secret key variable SYMM_KEY is not set\");\n}","typeGuard":null,"tryCatchPattern":"try {\n  trans.execute(null);\n} catch (KettleStepException e) {\n  if (e.getMessage().contains(\"SecretKeyMissing\")) {\n    logError(\"Provide the secret key or define the referenced variable\");\n  }\n}","preventionTips":["Define key variables in kettle.properties or pass them as transformation parameters.","Never leave the static key box empty when not using a key field.","Document required environment variables for deployments."],"tags":["kettle","pdi","encryption","missing-credentials"],"backgroundTag":"missing-env-var","analyzedSha":"f3058517a153da500bf4551f46d79b91bf8ec552","analyzedAt":"2026-09-13T14:04:16.340Z","contentChangedAt":"2026-09-13T14:04:16.340Z","schemaVersion":2},"datasetVersion":"2026-09-20T23:17:15.980Z"}