{"record":{"id":"c2eb58afc3734a25","repo":"apache/hadoop","slug":"credential-has-not-been-provided-in-configuration","errorCode":null,"errorMessage":"Credential has not been provided in configuration","messagePattern":"Credential has not been provided in configuration","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"hadoop-hdfs-project/hadoop-hdfs-client/src/main/java/org/apache/hadoop/hdfs/web/oauth2/ConfCredentialBasedAccessTokenProvider.java","lineNumber":56,"sourceCode":"  private String credential;\n\n  public ConfCredentialBasedAccessTokenProvider() {\n  }\n\n  public ConfCredentialBasedAccessTokenProvider(Timer timer) {\n    super(timer);\n  }\n\n  @Override\n  public void setConf(Configuration conf) {\n    super.setConf(conf);\n    credential = notNull(conf, OAUTH_CREDENTIAL_KEY);\n  }\n\n  @Override\n  public String getCredential() {\n    if(credential == null) {\n      throw new IllegalArgumentException(\"Credential has not been \" +\n          \"provided in configuration\");\n    }\n\n    return credential;\n  }\n}\n","sourceCodeStart":38,"sourceCodeEnd":63,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-hdfs-project/hadoop-hdfs-client/src/main/java/org/apache/hadoop/hdfs/web/oauth2/ConfCredentialBasedAccessTokenProvider.java#L38-L63","documentation":"ConfCredentialBasedAccessTokenProvider.getCredential throws IllegalArgumentException when the credential field is null. Normally setConf(conf) already loads it via Utils.notNull from the dfs.webhdfs.oauth2.credential key (which would throw 'No value for dfs.webhdfs.oauth2.credential found in conf file.' at ConfCredentialBasedAccessTokenProvider.java:50), so this residual guard fires only when getCredential() is called on a provider that was never configured — i.e., setConf was bypassed or failed before assignment.","triggerScenarios":"Constructing ConfCredentialBasedAccessTokenProvider and calling getCredential() without a prior setConf(); or custom wiring/injection that instantiates the provider but skips configuration (common in unit tests or custom FileSystem factories).","commonSituations":"Unit tests instantiating token providers directly; dependency-injected providers whose configure step silently failed; calling getCredential() from a different thread before initialization completed; copying example code that shows only the getter usage.","solutions":["Always call provider.setConf(conf) with a Configuration containing dfs.webhdfs.oauth2.credential before any getCredential() use","Prefer constructing providers through the configuration chain (dfs.webhdfs.oauth2.access.token.provider) so WebHdfsFileSystem initializes them","In tests, set the credential key on the test Configuration before setConf"],"exampleFix":"// before\nConfCredentialBasedAccessTokenProvider p = new ConfCredentialBasedAccessTokenProvider(timer);\nString cred = p.getCredential(); // credential == null -> throws\n// after\nConfiguration conf = new Configuration();\nconf.set(\"dfs.webhdfs.oauth2.credential\", \"my-credential\");\np.setConf(conf);\nString cred = p.getCredential();","handlingStrategy":"validation","validationCode":"Configuration conf = new Configuration();\nconf.set(\"dfs.webhdfs.oauth2.credential\", credential);\nprovider.setConf(conf);            // loads credential via Utils.notNull\nassert provider.getCredential() != null; // now guaranteed","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always setConf() a fully-populated Configuration before using an AccessTokenProvider","Let WebHdfsFileSystem create providers via dfs.webhdfs.oauth2.access.token.provider instead of manual construction","In tests, set the credential key before initialization"],"tags":["oauth2","webhdfs","configuration","initialization"],"backgroundTag":"missing-oauth2-credential","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-23T01:17:44.959Z"}