{"record":{"id":"db26f67dbc62108d","repo":"apache/hadoop","slug":"can-t-cast-key-for-name-in-keystore-path-to","errorCode":null,"errorMessage":"Can't cast key for ${name} in keystore ${path} to a KeyMetadata. Key may have been added using  keytool or some other non-Hadoop method.","messagePattern":"Can't cast key for (.+?) in keystore (.+?) to a KeyMetadata\\. Key may have been added using  keytool or some other non-Hadoop method\\.","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/JavaKeyStoreProvider.java","lineNumber":415,"sourceCode":"    }\n  }\n\n  @Override\n  public Metadata getMetadata(String name) throws IOException {\n    readLock.lock();\n    try {\n      if (cache.containsKey(name)) {\n        return cache.get(name);\n      }\n      try {\n        if (!keyStore.containsAlias(name)) {\n          return null;\n        }\n        Metadata meta = ((KeyMetadata) keyStore.getKey(name, password)).metadata;\n        cache.put(name, meta);\n        return meta;\n      } catch (ClassCastException e) {\n        throw new IOException(\"Can't cast key for \" + name + \" in keystore \" +\n            path + \" to a KeyMetadata. Key may have been added using \" +\n            \" keytool or some other non-Hadoop method.\", e);\n      } catch (KeyStoreException e) {\n        throw new IOException(\"Can't get metadata for \" + name +\n            \" from keystore \" + path, e);\n      } catch (NoSuchAlgorithmException e) {\n        throw new IOException(\"Can't get algorithm for \" + name +\n            \" from keystore \" + path, e);\n      } catch (UnrecoverableKeyException e) {\n        throw new IOException(\"Can't recover key for \" + name +\n            \" from keystore \" + path, e);\n      }\n    } finally {\n      readLock.unlock();\n    }\n  }\n\n  @Override","sourceCodeStart":397,"sourceCodeEnd":433,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/JavaKeyStoreProvider.java#L397-L433","documentation":"JavaKeyStoreProvider stores key metadata as a special key entry whose class is KeyProvider.KeyMetadata. getMetadata() casts the keystore entry to KeyMetadata; a ClassCastException means an alias with that name exists but holds a different entry type — i.e. it was created outside Hadoop (keytool, third-party tool) rather than by a Hadoop KeyProvider.","triggerScenarios":"KeyProvider.getMetadata(name) or any key operation (createKey/rollover/delete triggers metadata lookup) where an admin previously ran keytool -genseckey / -importpassword with an alias identical to the Hadoop key name in the same JCEKS file.","commonSituations":"Admins mixing keytool-managed secrets and Hadoop KMS keys in one keystore file; migrating credentials manually with keytool into the KMS keystore; tooling that writes generic JCEKS entries into the provider path","solutions":["Inspect the alias: keytool -list -keystore <path> -storetype jceks and compare entry types","Remove or rename the non-Hadoop alias: keytool -delete -alias <name> (or -changealias), after exporting any needed secret elsewhere","Re-create the key through KMS/Hadoop APIs (hadoop key create) so it carries proper KeyMetadata","Keep keytool-managed credentials in a separate keystore file from the Hadoop KMS keystore"],"exampleFix":"# before: alias 'mykey' was added via keytool -> getMetadata throws\nkeytool -list -keystore ks.jks -storetype jceks   # shows non-Hadoop entry\n\n# after: move the foreign secret out, then recreate via Hadoop\nkeytool -importkeystore ... # export the secret elsewhere if needed\nkeytool -delete -alias mykey -keystore ks.jks -storetype jceks\nhadoop key create mykey -size 128 -provider jceks://file/etc/security/ks.jks","handlingStrategy":"validation","validationCode":"// Detect foreign entries before they break key operations\nKeyStore ks = KeyStore.getInstance(\"jceks\");\nks.load(in, pwd);\nif (ks.containsAlias(name) && !ks.isKeyEntry(name)) {\n  throw new IllegalStateException(\"Alias \" + name + \" is not a Hadoop key entry; managed with keytool?\");\n}","typeGuard":"// Heuristic guard: Hadoop-managed keystores contain a '_metadata' companion alias\npublic boolean looksLikeHadoopManaged(KeyStore ks, String name) throws KeyStoreException {\n  return ks.containsAlias(name + \"_metadata\");\n}","tryCatchPattern":"try {\n  Metadata m = provider.getMetadata(name);\n} catch (IOException e) {\n  if (e.getCause() instanceof ClassCastException) {\n    // alias exists but was created by keytool: delete/rename it, then create via Hadoop API\n  }\n}","preventionTips":["Keep keytool secrets and Hadoop KMS keys in separate keystore files","Never manage KMS keystore entries with keytool directly","After any manual keystore edit, run `hadoop key list` as a smoke test"],"tags":["keystore","kms","crypto","metadata","keytool","type-mismatch"],"backgroundTag":"keystore-entry-type-mismatch","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}