{"record":{"id":"ae29b0b0866832c9","repo":"apache/hadoop","slug":"unable-to-get-key-from-credential-provider-for-acc","errorCode":null,"errorMessage":"Unable to get key from credential provider for account {accountName}","messagePattern":"Unable to get key from credential provider for account (.+?)","errorType":"exception","errorClass":"KeyProviderException","httpStatus":null,"severity":"error","filePath":"hadoop-tools/hadoop-azure/src/main/java/org/apache/hadoop/fs/azurebfs/services/ShellDecryptionKeyProvider.java","lineNumber":48,"sourceCode":"import org.slf4j.LoggerFactory;\n\n/**\n * Shell decryption key provider which invokes an external script that will\n * perform the key decryption.\n */\npublic class ShellDecryptionKeyProvider extends SimpleKeyProvider {\n  private static final Logger LOG = LoggerFactory.getLogger(ShellDecryptionKeyProvider.class);\n\n  @Override\n  public String getStorageAccountKey(String accountName, Configuration rawConfig)\n      throws KeyProviderException {\n    String envelope = super.getStorageAccountKey(accountName, rawConfig);\n\n    AbfsConfiguration abfsConfig;\n    try {\n      abfsConfig = new AbfsConfiguration(rawConfig, accountName);\n    } catch(IllegalAccessException | IOException e) {\n      throw new KeyProviderException(\"Unable to get key from credential provider for account \" + accountName, e);\n    }\n\n    final String command = abfsConfig.get(ConfigurationKeys.AZURE_KEY_ACCOUNT_SHELLKEYPROVIDER_SCRIPT);\n    if (command == null) {\n      throw new KeyProviderException(\n          \"Script path is not specified via fs.azure.shellkeyprovider.script\");\n    }\n\n    String[] cmd = command.split(\" \");\n    String[] cmdWithEnvelope = Arrays.copyOf(cmd, cmd.length + 1);\n    cmdWithEnvelope[cmdWithEnvelope.length - 1] = envelope;\n\n    String decryptedKey = null;\n    try {\n      decryptedKey = Shell.execCommand(cmdWithEnvelope);\n    } catch (IOException ex) {\n      throw new KeyProviderException(ex);\n    }","sourceCodeStart":30,"sourceCodeEnd":66,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-tools/hadoop-azure/src/main/java/org/apache/hadoop/fs/azurebfs/services/ShellDecryptionKeyProvider.java#L30-L66","documentation":"Error \"Unable to get key from credential provider for account {accountName}\" thrown in apache/hadoop.","triggerScenarios":"The shell decryption key provider script fails to return an account key.","commonSituations":"See trigger scenarios.","solutions":["Verify the shell key provider script path and that it outputs the key for the account on stdout.","Check script permissions and that it runs as the executing user."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-23T01:17:44.959Z"}