{"record":{"id":"bb567cb600d5abd2","repo":"apache/hadoop","slug":"password-key-not-found","errorCode":null,"errorMessage":"Password {key} not found","messagePattern":"Password (.+?) not found","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"hadoop-tools/hadoop-azure-datalake/src/main/java/org/apache/hadoop/fs/adl/AdlFileSystem.java","lineNumber":969,"sourceCode":"          \"No value for \" + key + \" found in conf file.\");\n    }\n    return value;\n  }\n\n  /**\n   * A wrapper of {@link Configuration#getPassword(String)}. It returns\n   * <code>String</code> instead of <code>char[]</code>.\n   *\n   * @param conf the configuration\n   * @param key the property key\n   * @return the password string\n   * @throws IOException if the password was not found\n   */\n  private static String getPasswordString(Configuration conf, String key)\n      throws IOException {\n    char[] passchars = conf.getPassword(key);\n    if (passchars == null) {\n      throw new IOException(\"Password \" + key + \" not found\");\n    }\n    return new String(passchars);\n  }\n\n  @VisibleForTesting\n  public void setUserGroupRepresentationAsUPN(boolean enableUPN) {\n    oidOrUpn = enableUPN ? UserGroupRepresentation.UPN :\n        UserGroupRepresentation.OID;\n  }\n\n  /**\n   * Gets ADL account name from ADL FQDN.\n   * @param accountFQDN ADL account fqdn\n   * @return ADL account name\n   */\n  public static String getAccountNameFromFQDN(String accountFQDN) {\n    return accountFQDN.contains(\".\")\n            ? accountFQDN.substring(0, accountFQDN.indexOf(\".\"))","sourceCodeStart":951,"sourceCodeEnd":987,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-tools/hadoop-azure-datalake/src/main/java/org/apache/hadoop/fs/adl/AdlFileSystem.java#L951-L987","documentation":"Thrown by AdlFileSystem.getPasswordString, a thin wrapper over Configuration.getPassword(String) that returns the secret as a String for Azure Data Lake (adl://) OAuth2 setup. getPassword resolves the key from configuration XML and transparently from Hadoop Credential Providers, so this IOException means the key exists nowhere: not in core-site.xml, not set programmatically, and no matching alias in the configured credential store. The exact offending key name is included in the message.","triggerScenarios":"Initializing an adl:// FileSystem when one of the ADL OAuth2 keys (dfs.adls.oauth2.client.id, dfs.adls.oauth2.credential, dfs.adls.oauth2.refresh.url, dfs.adls.oauth2.refresh.token, per AdlConfKeys) resolves to null. The provider path at AdlFileSystem.java:303-312 calls getPasswordString for client-id/refresh-url/client-secret (client-credential flow) or client-id/refresh-token (refresh-token flow).","commonSituations":"Cluster migrated and the ADL secrets were never re-provisioned; a typo in the dfs.adls.oauth2.* property name so getPassword returns null; the secret lives in a jceks store but hadoop.security.credential.provider.path is missing or points at the wrong URI; tests running with a stripped-down Configuration.","solutions":["Set the missing key (the message names it) in core-site.xml or via conf.set/conf.setPassword before the filesystem is initialized","If using a credential provider, create the alias: hadoop credential create dfs.adls.oauth2.credential -provider jceks:///path/store.jceks, and set hadoop.security.credential.provider.path to that URI","Verify the alias resolves: hadoop credential list -provider jceks:///path/store.jceks","Double-check spelling of the dfs.adls.oauth2.* keys against AdlConfKeys for your Hadoop version"],"exampleFix":"// before: core-site.xml has no dfs.adls.oauth2.credential\n// -> IOException: Password dfs.adls.oauth2.credential not found\n\n// after (in XML)\n<property>\n  <name>dfs.adls.oauth2.credential</name>\n  <value>...</value>\n</property>\n\n// after (secret kept out of XML)\n<property>\n  <name>hadoop.security.credential.provider.path</name>\n  <value>jceks:///etc/security/adl.jceks</value>\n</property>","handlingStrategy":"validation","validationCode":"import org.apache.hadoop.conf.Configuration;\nimport java.io.IOException;\n\nstatic void requireAdlSecrets(Configuration conf) throws IOException {\n  String[] keys = {\n      \"dfs.adls.oauth2.client.id\",\n      \"dfs.adls.oauth2.refresh.url\",\n      \"dfs.adls.oauth2.credential\" };\n  for (String key : keys) {\n    if (conf.getPassword(key) == null) {\n      throw new IOException(\"Missing required secret '\" + key\n          + \"': set it in core-site.xml or provision it via \"\n          + \"hadoop credential create \" + key + \" -provider jceks://...\");\n    }\n  }\n}\n// call before any AdlFileSystem operation","typeGuard":null,"tryCatchPattern":"Wrap filesystem acquisition (FileSystem.get(adlUri, conf)) in try/catch IOException; when the message starts with 'Password ' and ends with ' not found', report the named key and abort startup with a provisioning hint instead of retrying.","preventionTips":["Always read/write secrets through Configuration.getPassword/setPassword so credential providers are honored","Smoke-test after deployment: hadoop credential list plus a tiny fs.exists() call against the ADL root","Keep the dfs.adls.oauth2.* keys in a reviewed core-site template with values injected from a vault or jceks store"],"tags":["azure-data-lake","adl","oauth2","credentials","credential-provider","configuration"],"backgroundTag":"missing-credential-configuration","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-23T01:17:44.959Z"}