{"record":{"id":"aec22ccc31939c8c","repo":"apache/hadoop","slug":"no-keyprovider-is-configured-cannot-access-an-enc","errorCode":null,"errorMessage":"No KeyProvider is configured, cannot access an encrypted file","messagePattern":"No KeyProvider is configured, cannot access an encrypted file","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"hadoop-hdfs-project/hadoop-hdfs-client/src/main/java/org/apache/hadoop/hdfs/HdfsKMSUtil.java","lineNumber":207,"sourceCode":"      Configuration conf) throws IOException {\n    // File is encrypted, wrap the stream in a crypto stream.\n    // Currently only one version, so no special logic based on the version#\n    HdfsKMSUtil.getCryptoProtocolVersion(fileEncryptionInfo);\n    final CryptoCodec codec = HdfsKMSUtil.getCryptoCodec(\n        conf, fileEncryptionInfo);\n    final KeyVersion decrypted =\n        decryptEncryptedDataEncryptionKey(fileEncryptionInfo, keyProvider);\n    return new CryptoInputStream(is, codec, decrypted.getMaterial(),\n        fileEncryptionInfo.getIV());\n  }\n\n  /**\n   * Decrypts a EDEK by consulting the KeyProvider.\n   */\n  static KeyVersion decryptEncryptedDataEncryptionKey(FileEncryptionInfo\n      feInfo, KeyProvider keyProvider) throws IOException {\n    if (keyProvider == null) {\n      throw new IOException(\"No KeyProvider is configured, cannot access\" +\n          \" an encrypted file\");\n    }\n    EncryptedKeyVersion ekv = EncryptedKeyVersion.createForDecryption(\n        feInfo.getKeyName(), feInfo.getEzKeyVersionName(), feInfo.getIV(),\n        feInfo.getEncryptedDataEncryptionKey());\n    try {\n      KeyProviderCryptoExtension cryptoProvider = KeyProviderCryptoExtension\n          .createKeyProviderCryptoExtension(keyProvider);\n      return cryptoProvider.decryptEncryptedKey(ekv);\n    } catch (GeneralSecurityException e) {\n      throw new IOException(e);\n    }\n  }\n}\n","sourceCodeStart":189,"sourceCodeEnd":222,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-hdfs-project/hadoop-hdfs-client/src/main/java/org/apache/hadoop/hdfs/HdfsKMSUtil.java#L189-L222","documentation":"To decrypt a file's EDEK (encrypted data-encryption key), HdfsKMSUtil.decryptEncryptedDataEncryptionKey requires a KeyProvider; if the client has none configured, it throws this IOException before attempting decryption. The KeyProvider normally comes from dfs.encryption.key.provider.uri / hadoop.security.key.provider.path resolving to the cluster's KMS. Any read of an encryption-zone file needs it, even just to open the stream.","triggerScenarios":"Opening/reading a file inside an HDFS encryption zone from a client whose Configuration has no dfs.encryption.key.provider.uri (and no hadoop.security.key.provider.path.uri fallback): raw new Configuration() in app code, edge nodes without KMS config, or the KMS URI scheme typo'd so provider creation was skipped.","commonSituations":"Custom Java/Spark/Hive clients assembled without the cluster's core-site.xml (which carries dfs.encryption.key.provider.uri=kms://https@HOST:9600/kms); moving jobs to new edge nodes that were never provisioned with KMS TLS config; credential-provider setups where the KMS URI lives in a JCEKS not loaded by the client.","solutions":["Set dfs.encryption.key.provider.uri (e.g. kms://https@kms-host:9600/kms) in the client's core-site.xml or Configuration","Load the cluster's core-site.xml/hdfs-site.xml on the client (conf.addResource) instead of an empty Configuration","Confirm the KMS is running and reachable on that URI, and that TLS/SSL client config allows the connection","For keyserver-less setups, configure a fallback provider via hadoop.security.key.provider.path.uri"],"exampleFix":"// before\nConfiguration conf = new Configuration(); // no key provider -> IOException on EZ read\n\n// after\nConfiguration conf = new Configuration();\nconf.set(\"dfs.encryption.key.provider.uri\", \"kms://https@kms-host:9600/kms\");","handlingStrategy":"validation","validationCode":"// Before opening files that may live in an EZ, ensure a key provider is set:\nString provider = conf.get(\"dfs.encryption.key.provider.uri\",\n    conf.get(\"hadoop.security.key.provider.path.uri\"));\nif (provider == null) {\n  throw new IllegalStateException(\n      \"Configure dfs.encryption.key.provider.uri (KMS) before reading encrypted data\");\n}","typeGuard":null,"tryCatchPattern":"try {\n  in = fs.open(encryptedPath);\n} catch (IOException e) {\n  if (e.getMessage().contains(\"No KeyProvider is configured\")) {\n    throw new IllegalStateException(\"Missing KMS config: set dfs.encryption.key.provider.uri\", e);\n  }\n  throw e;\n}","preventionTips":["Always load the cluster's core-site.xml (which carries the KMS URI) in client Configurations","Add a startup check for dfs.encryption.key.provider.uri when the app may touch encryption zones","Provision edge nodes with KMS TLS truststores alongside the Hadoop config"],"tags":["hdfs","encryption","kms","key-provider","configuration"],"backgroundTag":"missing-key-provider","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}