{"record":{"id":"c48bf1daca0c0f26","repo":"apache/beam","slug":"exception-getting-credentials","errorCode":null,"errorMessage":"Exception getting credentials ","messagePattern":"Exception getting credentials ","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"sdks/java/io/google-cloud-platform/src/main/java/org/apache/beam/sdk/io/gcp/bigtable/BigtableConfigTranslator.java","lineNumber":151,"sourceCode":"    // Skip resetting the credentials if it's connected to an emulator\n    if (!emulator) {\n      if (pipelineOptions.as(GcpOptions.class).getGcpCredential() != null) {\n        dataBuilder\n            .stubSettings()\n            .setCredentialsProvider(\n                FixedCredentialsProvider.create(\n                    pipelineOptions.as(GcpOptions.class).getGcpCredential()));\n      }\n\n      if (config.getCredentialFactory() != null) {\n        CredentialFactory credentialFactory = config.getCredentialFactory();\n        try {\n          dataBuilder\n              .stubSettings()\n              .setCredentialsProvider(\n                  FixedCredentialsProvider.create(credentialFactory.getCredential()));\n        } catch (GeneralSecurityException e) {\n          throw new RuntimeException(\"Exception getting credentials \", e);\n        }\n      }\n    }\n\n    configureChannelPool(dataBuilder.stubSettings(), config);\n    configureHeaderProvider(dataBuilder.stubSettings(), pipelineOptions);\n\n    // Provide a way to override any BigtableDataSettings\n    String overrideClassName =\n        ExperimentalOptions.getExperimentValue(pipelineOptions, BIGTABLE_SETTINGS_OVERRIDE);\n\n    return configureSettingsOverride(overrideClassName, dataBuilder, pipelineOptions);\n  }\n\n  private static BigtableDataSettings.Builder configureSettingsOverride(\n      @Nullable String override,\n      BigtableDataSettings.Builder dataBuilder,\n      PipelineOptions pipelineOptions) {","sourceCodeStart":133,"sourceCodeEnd":169,"githubUrl":"https://github.com/apache/beam/blob/12126d8942aaf848030c478b4c6a28c6af861c66/sdks/java/io/google-cloud-platform/src/main/java/org/apache/beam/sdk/io/gcp/bigtable/BigtableConfigTranslator.java#L133-L169","documentation":"buildBigtableDataSettings installs a FixedCredentialsProvider built from the configured credentialFactory. If obtaining the GoogleCredentials throws GeneralSecurityException, it is wrapped in this RuntimeException so pipeline translation fails loudly rather than continuing without credentials.","triggerScenarios":"Translating a BigtableConfig with explicit credentials where credentialFactory.getCredential() raises GeneralSecurityException (bad key material, corrupt service-account file, invalid key format).","commonSituations":"Malformed or expired service-account JSON/PEM; wrong key algorithm; credentials file edited or truncated; test fixtures with fake key data.","solutions":["Regenerate or re-download the service account key / credentials and confirm the file loads (e.g. ServiceAccountCredentials.fromStream).","Verify the credentialFactory configuration (path, key type, passphrase) used to build the BigtableConfig.","Consider relying on Application Default Credentials instead of explicit credential material to avoid key handling errors."],"exampleFix":"// before\nBigtableConfig config = BigtableConfig.newBuilder().setCredentialFactory(new FancyCredentialFactory(\"bad.pem\")).build();\n// after\nBigtableConfig config = BigtableConfig.newBuilder()\n    .setCredentialFactory(new ServiceAccountJsonCredentialFactory(\"/valid/sa.json\")).build();","handlingStrategy":"try-catch","validationCode":"// pre-flight: load credentials once before submitting the job\nGoogleCredentials creds = credentialFactory.getCredential(); // fails fast locally\nif (creds == null) throw new IllegalStateException(\"No credentials configured\");","typeGuard":null,"tryCatchPattern":"try { settings = translator.buildBigtableDataSettings(config, options); } catch (RuntimeException e) { if (e.getMessage().startsWith(\"Exception getting credentials\")) { log.error(\"Fix the Bigtable credentialFactory config\", e); } throw e; }","preventionTips":["Test credential loading in a unit test before pipeline submission.","Prefer Application Default Credentials over hand-managed key files.","Validate service-account JSON with ServiceAccountCredentials.fromStream locally."],"tags":["bigtable","credentials","security"],"backgroundTag":"missing-credentials","analyzedSha":"12126d8942aaf848030c478b4c6a28c6af861c66","analyzedAt":"2026-09-13T01:50:10.254Z","contentChangedAt":"2026-09-13T01:50:10.254Z","schemaVersion":2},"datasetVersion":"2026-09-20T03:17:13.778Z"}