{"record":{"id":"cb0c011e4b5566cc","repo":"grpc/grpc-java","slug":"localcredentials-are-not-supported-in-grpc-java-s","errorCode":null,"errorMessage":"LocalCredentials are not supported in grpc-java. See https://github.com/grpc/grpc-java/issues/8928","messagePattern":"LocalCredentials are not supported in grpc-java\\. See https://github\\.com/grpc/grpc-java/issues/8928","errorType":"validation","errorClass":"GrpcServiceParseException","httpStatus":null,"severity":"error","filePath":"xds/src/main/java/io/grpc/xds/GrpcServiceConfigParser.java","lineNumber":225,"sourceCode":"          return Optional\n              .of(ConfiguredChannelCredentials.create(GoogleDefaultChannelCredentials.create(),\n                  new ProtoChannelCredsConfig(typeUrl, cred)));\n        case INSECURE_CREDENTIALS_TYPE_URL:\n          return Optional.of(ConfiguredChannelCredentials.create(\n              InsecureChannelCredentials.create(), new ProtoChannelCredsConfig(typeUrl, cred)));\n        case XDS_CREDENTIALS_TYPE_URL:\n          XdsCredentials xdsConfig = cred.unpack(XdsCredentials.class);\n          Optional<ConfiguredChannelCredentials> fallbackCreds =\n              channelCredsFromProto(xdsConfig.getFallbackCredentials());\n          if (!fallbackCreds.isPresent()) {\n            throw new GrpcServiceParseException(\n                \"Unsupported fallback credentials type for XdsCredentials\");\n          }\n          return Optional.of(ConfiguredChannelCredentials.create(\n              XdsChannelCredentials.create(fallbackCreds.get().channelCredentials()),\n              new ProtoChannelCredsConfig(typeUrl, cred)));\n        case LOCAL_CREDENTIALS_TYPE_URL:\n          throw new GrpcServiceParseException(\n              \"LocalCredentials are not supported in grpc-java. \"\n                  + \"See https://github.com/grpc/grpc-java/issues/8928\");\n        case TLS_CREDENTIALS_TYPE_URL:\n          // For this PR, we establish this structural skeleton,\n          // but throw an GrpcServiceParseException until the exact stream conversions are\n          // merged.\n          throw new GrpcServiceParseException(\n              \"TlsCredentials input stream construction pending.\");\n        default:\n          return Optional.empty();\n      }\n    } catch (InvalidProtocolBufferException e) {\n      throw new GrpcServiceParseException(\"Failed to parse channel credentials: \" + e.getMessage());\n    }\n  }\n\n  private static ConfiguredChannelCredentials extractChannelCredentials(\n      List<Any> channelCredentialPlugins) throws GrpcServiceParseException {","sourceCodeStart":207,"sourceCodeEnd":243,"githubUrl":"https://github.com/grpc/grpc-java/blob/64daddc1f3d1975670f769f3e97bde8b2ba32d25/xds/src/main/java/io/grpc/xds/GrpcServiceConfigParser.java#L207-L243","documentation":"grpc-java's xDS service config parser encountered aLOCAL_CREDENTIALS_TYPE_URL channel-credentials plugin in the xDS bootstrap/config. LocalCredentials (UDS-style/local security) are intentionally unimplemented in grpc-java, tracked upstream in grpc-java issue #8928, so the parser throws GrpcServiceParseException instead of silently misconfiguring the channel.","triggerScenarios":"A ChannelCredentialsConfig proto (from xDS bootstrap or server-provided config) contains a channel_credentials_plugins entry whose Any type_url is LOCAL_CREDENTIALS_TYPE_URL; channelCredsFromProto is invoked via fallbackCreds or parsed and hits the LOCAL_CREDENTIALS_TYPE_URL switch case.","commonSituations":"A bootstrap file or control plane config generated for another gRPC language (e.g. C++ or Python) that supports LocalCredentials is consumed by a grpc-java client; copy-pasted xDS credential configs from non-Java examples.","solutions":["Remove the local_credentials plugin from the xDS channel credentials config and use google_default, tls, or xds credentials supported by grpc-java","Regenerate/translate the bootstrap config for Java using only grpc-java-supported credential type URLs","Track/await upstream support in grpc-java issue #8928 if LocalCredentials are a hard requirement"],"exampleFix":"// before (bootstrap JSON channel creds plugin)\n{\"type_url\": \"type.googleapis.com/grpc.gcp.relay.LocalCredentials\"}\n// after\n{\"type_url\": \"type.googleapis.com/grpc.gcp.relay.TlsCredentials\"} // or google_default\n","handlingStrategy":"try-catch","validationCode":"// Pre-check: skip configs using local_credentials\nString typeUrl = plugin.getTypeUrl();\nif (typeUrl.contains(\"LocalCredentials\")) {\n  throw new IllegalArgumentException(\"LocalCredentials unsupported in grpc-java\");\n}","typeGuard":"boolean isSupportedCredsType(Any cred) {\n  String u = cred.getTypeUrl();\n  return u != null && !u.contains(\"LocalCredentials\");\n}","tryCatchPattern":"try {\n  XdsChannelCredentialsProvider.parse(config);\n} catch (GrpcServiceParseException e) {\n  if (e.getMessage().contains(\"LocalCredentials\")) {\n    // fall back to google_default credentials\n  } else throw e;\n}","preventionTips":["Never reuse bootstrap files written for C++/Python gRPC directly in Java","Keep a Java-specific bootstrap template listing only supported credential types","Watch grpc-java issue #8928 for when LocalCredentials land"],"tags":["xds","grpc-java","credentials","unsupported"],"backgroundTag":"unsupported-operation","analyzedSha":"64daddc1f3d1975670f769f3e97bde8b2ba32d25","analyzedAt":"2026-09-08T06:14:57.704Z","contentChangedAt":"2026-09-08T06:14:57.704Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}