{"record":{"id":"d198dfc19cd846ff","repo":"apache/hadoop","slug":"invalid-credentials","errorCode":null,"errorMessage":"Invalid credentials","messagePattern":"Invalid credentials","errorType":"validation","errorClass":"InvalidCredentialsException","httpStatus":null,"severity":"critical","filePath":"hadoop-tools/hadoop-aliyun/src/main/java/org/apache/hadoop/fs/aliyun/oss/AliyunCredentialsProvider.java","lineNumber":81,"sourceCode":"          securityToken);\n    } else {\n      credentials = new DefaultCredentials(accessKeyId, accessKeySecret);\n    }\n  }\n\n  @Override\n  public void setCredentials(Credentials creds) {\n    if (creds == null) {\n      throw new InvalidCredentialsException(\"Credentials should not be null.\");\n    }\n\n    credentials = creds;\n  }\n\n  @Override\n  public Credentials getCredentials() {\n    if (credentials == null) {\n      throw new InvalidCredentialsException(\"Invalid credentials\");\n    }\n\n    return credentials;\n  }\n}\n","sourceCodeStart":63,"sourceCodeEnd":87,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-tools/hadoop-aliyun/src/main/java/org/apache/hadoop/fs/aliyun/oss/AliyunCredentialsProvider.java#L63-L87","documentation":"Thrown by AliyunCredentialsProvider.getCredentials() when the internal credentials field is still null. In practice the constructor already builds credentials from fs.oss.accessKeyId/fs.oss.accessKeySecret (and throws InvalidCredentialsException itself if they are missing), so reaching getCredentials() with a null field means the provider was constructed without configuration or the field was never set after a failed refresh.","triggerScenarios":"Instantiating AliyunCredentialsProvider in a way that bypasses the configuration path and never calling setCredentials; calling getCredentials() before any credentials were established; a refresh flow that nulled the field before the getter ran.","commonSituations":"Unit tests that new the provider with an empty Configuration path; SDK versions where provider instantiation is lazy and getCredentials is invoked during the first OSS request; embedding the provider in custom OSS client code that assumes a default credential chain exists (it does not in this class).","solutions":["Set fs.oss.accessKeyId and fs.oss.accessKeySecret (and optionally fs.oss.securityToken) in core-site.xml or the Configuration passed to the provider so the constructor populates credentials","If using the provider standalone, call setCredentials(new DefaultCredentials(id, secret)) before the first getCredentials()","For temporary credentials, configure fs.oss.credentials.provider with an STS-aware provider class instead of relying on manual set/get"],"exampleFix":"// before\nAliyunCredentialsProvider p = new AliyunCredentialsProvider(conf);\nCredentials c = p.getCredentials(); // InvalidCredentialsException\n\n// after\nconf.set(\"fs.oss.accessKeyId\", id);\nconf.set(\"fs.oss.accessKeySecret\", secret);\nCredentials c = new AliyunCredentialsProvider(conf).getCredentials();","handlingStrategy":"validation","validationCode":"String id = conf.get(\"fs.oss.accessKeyId\");\nString secret = conf.get(\"fs.oss.accessKeySecret\");\nif (StringUtils.isAnyBlank(id, secret)) {\n  throw new IOException(\"fs.oss.accessKeyId/accessKeySecret not configured\");\n}\nnew AliyunCredentialsProvider(conf).getCredentials();","typeGuard":null,"tryCatchPattern":"catch (InvalidCredentialsException e) { // config problem, not transient: report missing keys and fail job setup throw e; }","preventionTips":["Validate that fs.oss.accessKeyId and fs.oss.accessKeySecret resolve (plain or via credential provider) before initializing the OSS filesystem","For STS, always include fs.oss.securityToken or use an STS-aware provider class"],"tags":["aliyun-oss","credentials","missing-configuration","hadoop-connector"],"backgroundTag":"missing-credentials-configuration","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}