{"record":{"id":"d9335cd3a10ec099","repo":"apache/hadoop","slug":"bad-configuration-of-hadoop-security-credential-pr","errorCode":null,"errorMessage":"Bad configuration of hadoop.security.credential.provider.path at {}","messagePattern":"Bad configuration of hadoop\\.security\\.credential\\.provider\\.path at (.+?)","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/alias/CredentialProviderFactory.java","lineNumber":107,"sourceCode":"            }\n            for (CredentialProviderFactory factory : serviceLoader) {\n              CredentialProvider kp = factory.createProvider(uri, conf);\n              if (kp != null) {\n                result.add(kp);\n                found = true;\n                break;\n              }\n            }\n          } finally {\n            SERVICE_LOADER_LOCKED.set(false);\n          }\n        }\n        if (!found) {\n          throw new IOException(\"No CredentialProviderFactory for \" + uri + \" in \" +\n              CREDENTIAL_PROVIDER_PATH);\n        }\n      } catch (URISyntaxException error) {\n        throw new IOException(\"Bad configuration of \" + CREDENTIAL_PROVIDER_PATH +\n            \" at \" + path, error);\n      }\n    }\n    return result;\n  }\n}\n","sourceCodeStart":89,"sourceCodeEnd":114,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/alias/CredentialProviderFactory.java#L89-L114","documentation":"Each entry of hadoop.security.credential.provider.path is parsed with new URI(path); a URISyntaxException is wrapped as this IOException. The entry is not a syntactically valid URI - typically unencoded spaces or special characters, an embedded Windows drive path, or stray characters - so no provider was even consulted.","triggerScenarios":"Paths containing spaces ('jceks://file/C:/Program Files/creds.jceks'), non-ASCII or reserved characters (%, #, ?), Windows paths like 'jceks://file/C:/creds.jceks' (colon in authority position), or trailing garbage after copy-paste.","commonSituations":"Windows installs; keystore file names with spaces; locales producing smart quotes in XML config; shell quoting that injects characters into the env var.","solutions":["Percent-encode unsafe characters: space as %20 (jceks://file/home/u/my%20creds.jceks)","On Windows use the file:/// authority form: jceks://file/C:/creds.jceks only if it parses; otherwise localjceks://file/C:/creds.jceks","Rename the keystore file to a scheme-safe name without spaces/specials - simplest fix","Validate every entry with new URI(entry) in a scratch program or jshell before pushing config"],"exampleFix":"# before\njceks://file/home/hadoop/my creds.jceks   # URISyntaxException\n\n# after\njceks://file/home/hadoop/my%20creds.jceks","handlingStrategy":"validation","validationCode":"// Reject syntactically invalid entries before Hadoop hits URISyntaxException\nstatic void validateUris(Configuration conf) throws IOException {\n  for (String entry : conf.getStringCollection(\"hadoop.security.credential.provider.path\")) {\n    try {\n      new java.net.URI(entry);\n    } catch (java.net.URISyntaxException e) {\n      throw new IOException(\"Invalid provider path entry '\" + entry + \"': \" + e.getReason(), e);\n    }\n  }\n}","typeGuard":null,"tryCatchPattern":"try {\n  providers = CredentialProviderFactory.getProviders(conf);\n} catch (IOException ex) {\n  if (ex.getMessage() != null && ex.getMessage().contains(\"Bad configuration of\")) {\n    // an entry failed URI parsing: find spaces/specials, percent-encode or rename the file\n  } else { throw ex; }\n}","preventionTips":["Avoid spaces and non-ASCII characters in keystore file names","URI-encode paths you cannot rename (space -> %20)","Quote XML property values and avoid smart quotes when pasting paths into config files"],"tags":["hadoop","credential-provider","uri","configuration","syntax"],"backgroundTag":"invalid-uri-syntax","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}