{"record":{"id":"a29efcc9ce482fd6","repo":"apache/hadoop","slug":"proxy-error-fs-s3a-proxy-username-or-fs-s3a-proxy","errorCode":null,"errorMessage":"Proxy error: fs.s3a.proxy.username or fs.s3a.proxy.password set without the other.","messagePattern":"Proxy error: fs\\.s3a\\.proxy\\.username or fs\\.s3a\\.proxy\\.password set without the other\\.","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"hadoop-tools/hadoop-aws/src/main/java/org/apache/hadoop/fs/s3a/impl/AWSClientConfig.java","lineNumber":260,"sourceCode":"        proxyConfigBuilder.endpoint(buildURI(scheme, proxyHost, proxyPort));\n      } else {\n        if (conf.getBoolean(PROXY_SECURED, false)) {\n          LOG.warn(\"Proxy host set without port. Using HTTPS default 443\");\n          proxyConfigBuilder.endpoint(buildURI(\"https\", proxyHost, 443));\n        } else {\n          LOG.warn(\"Proxy host set without port. Using HTTP default 80\");\n          proxyConfigBuilder.endpoint(buildURI(\"http\", proxyHost, 80));\n        }\n      }\n      final String proxyUsername = S3AUtils.lookupPassword(bucket, conf, PROXY_USERNAME,\n          null, null);\n      final String proxyPassword = S3AUtils.lookupPassword(bucket, conf, PROXY_PASSWORD,\n          null, null);\n      if ((proxyUsername == null) != (proxyPassword == null)) {\n        String msg = \"Proxy error: \" + PROXY_USERNAME + \" or \" +\n            PROXY_PASSWORD + \" set without the other.\";\n        LOG.error(msg);\n        throw new IllegalArgumentException(msg);\n      }\n      proxyConfigBuilder.username(proxyUsername);\n      proxyConfigBuilder.password(proxyPassword);\n      proxyConfigBuilder.ntlmDomain(conf.getTrimmed(PROXY_DOMAIN));\n      proxyConfigBuilder.ntlmWorkstation(conf.getTrimmed(PROXY_WORKSTATION));\n      if (LOG.isDebugEnabled()) {\n        LOG.debug(\"Using proxy server {}:{} as user {} with password {} on \"\n                + \"domain {} as workstation {}\", proxyHost, proxyPort, proxyUsername, proxyPassword,\n            PROXY_DOMAIN, PROXY_WORKSTATION);\n      }\n    } else if (proxyPort >= 0) {\n      String msg =\n          \"Proxy error: \" + PROXY_PORT + \" set without \" + PROXY_HOST;\n      LOG.error(msg);\n      throw new IllegalArgumentException(msg);\n    }\n\n    return proxyConfigBuilder.build();","sourceCodeStart":242,"sourceCodeEnd":278,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-tools/hadoop-aws/src/main/java/org/apache/hadoop/fs/s3a/impl/AWSClientConfig.java#L242-L278","documentation":"IllegalArgumentException from AWSClientConfig's sync proxy setup when exactly one of fs.s3a.proxy.username / fs.s3a.proxy.password is configured ((username == null) != (password == null)). The AWS SDK proxy builder requires both credentials together. Passwords are resolved through S3AUtils.lookupPassword, so the password may come from a credential provider file -- if that entry is missing on some node, the value resolves to null there and triggers this error even though the username is set in core-site.xml.","triggerScenarios":"Building the S3A client (any FS initialization, e.g. FileSystem.get on s3a://) on a node where fs.s3a.proxy.username is set but fs.s3a.proxy.password is unset, or vice versa.","commonSituations":"Username hardcoded in core-site.xml while the password is sourced from a password file/jceks that is missing or lacks the fs.s3a.proxy.password entry on part of the cluster; password was removed for a 'no-auth proxy' migration but the username was forgotten.","solutions":["Set both fs.s3a.proxy.username and fs.s3a.proxy.password (or remove both if the proxy needs no authentication)","If the password comes from a credential provider, verify the provider file exists on every node and actually contains the fs.s3a.proxy.password entry","Note the same rule is enforced in the async client path (line ~329), so fixing only one code path is not enough -- fix the config"],"exampleFix":"<!-- before -->\n<property><name>fs.s3a.proxy.host</name><value>proxy.corp</value></property>\n<property><name>fs.s3a.proxy.username</name><value>alice</value></property>\n\n<!-- after -->\n<property><name>fs.s3a.proxy.host</name><value>proxy.corp</value></property>\n<property><name>fs.s3a.proxy.username</name><value>alice</value></property>\n<property><name>fs.s3a.proxy.password</name><value>${credential-store alias}</value></property>","handlingStrategy":"validation","validationCode":"Configuration c = fs.getConf();\nString u = S3AUtils.lookupPassword(bucket, c, PROXY_USERNAME, null, null);\nString p = S3AUtils.lookupPassword(bucket, c, PROXY_PASSWORD, null, null);\nif ((u == null) != (p == null)) {\n  throw new IllegalArgumentException(\"Both proxy username and password must be set, or neither\");\n}","typeGuard":null,"tryCatchPattern":"try {\n  FileSystem fs = path.getFileSystem(conf);\n} catch (IllegalArgumentException e) {\n  if (e.getMessage().contains(\"fs.s3a.proxy.username\")) {\n    // config problem, not code: fix core-site/credential provider, no point retrying\n    throw new ConfigurationException(\"Proxy credentials incomplete\", e);\n  }\n  throw e;\n}","preventionTips":["Deploy credential-provider files containing fs.s3a.proxy.password to every node, not just gateways","Automate config checks that assert username and password are both present or both absent","Remember lookupPassword resolves from providers -- a missing alias behaves like an unset key"],"tags":["s3a","proxy","configuration","credentials"],"backgroundTag":"proxy-misconfiguration","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}