{"record":{"id":"e1a8335744202a57","repo":"apache/hadoop","slug":"no-aws-credential-providers-created-by-delegation","errorCode":null,"errorMessage":"No AWS credential providers created by Delegation Token Binding {tokenBindingName}","messagePattern":"No AWS credential providers created by Delegation Token Binding (.+?)","errorType":"exception","errorClass":"DelegationTokenIOException","httpStatus":null,"severity":"error","filePath":"hadoop-tools/hadoop-aws/src/main/java/org/apache/hadoop/fs/s3a/auth/delegation/S3ADelegationTokens.java","lineNumber":284,"sourceCode":"   *\n   * This means after this call (and only after) the token operations\n   * can be invoked.\n   *\n   * This method is called from {@link #serviceStart()}, so a check on\n   * the service state can be used to check things; the state model\n   * prevents re-entrant calls.\n   * @throws IOException selection/extraction/validation failure.\n   */\n  private void bindToAnyDelegationToken() throws IOException {\n    checkState(!bindingInfo.isPresent(), E_ALREADY_DEPLOYED);\n    Token<AbstractS3ATokenIdentifier> token = selectTokenFromFSOwner();\n    if (token != null) {\n      bindToDelegationToken(token);\n    } else {\n      deployUnbonded();\n    }\n    if (getCredentialProviders().size() == 0) {\n      throw new DelegationTokenIOException(\"No AWS credential providers\"\n          + \" created by Delegation Token Binding \"\n          + tokenBinding.getName());\n    }\n  }\n\n  /**\n   * This is a test-only back door which resets the state and binds to\n   * a token again.\n   * This allows an instance of this class to be bonded to a DT after being\n   * started, so avoids the need to have the token in the current user\n   * credentials. It is package scoped so as to only be usable in tests\n   * in the same package.\n   *\n   * Yes, this is ugly, but there is no obvious/easy way to test token\n   * binding without Kerberos getting involved.\n   * @param token token to decode and bind to.\n   * @throws IOException selection/extraction/validation failure.\n   */","sourceCodeStart":266,"sourceCodeEnd":302,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-tools/hadoop-aws/src/main/java/org/apache/hadoop/fs/s3a/auth/delegation/S3ADelegationTokens.java#L266-L302","documentation":"After S3ADelegationTokens binds to a token or deploys unbonded, it asserts that the active delegation-token binding produced at least one AWSCredentialProvider for the filesystem to authenticate with. Zero providers means the binding deployed but supplied nothing usable, which would otherwise surface later as an obscure authentication failure, so it fails fast naming the binding.","triggerScenarios":"bindToAnyDelegationToken completes and getCredentialProviders().size() == 0. Typical with a custom or third-party token binding whose bindToDelegationToken/deployUnbonded implementation returns an empty provider list, or a binding version mismatch where the provider-creation path is skipped.","commonSituations":"Custom delegation-token bindings under development that forget to add providers; misconfigured binding class that deploys but does not wire credentials; upgrading a custom binding without updating its integration.","solutions":["Check fs.s3a.delegation.token.binding: use a standard binding (org.apache.hadoop.fs.s3a.auth.delegation.S3ATokenBinding or SessionTokenBinding) unless you really need a custom one","If the binding is custom, fix its deploy/bind path to return at least one AWSCredentialProvider","Verify the binding class version matches the hadoop-aws version on the classpath"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"String binding = conf.getTrimmed(\"fs.s3a.delegation.token.binding\", \"\");\nSet<String> known = Set.of(\n    \"org.apache.hadoop.fs.s3a.auth.delegation.S3ATokenBinding\",\n    \"org.apache.hadoop.fs.s3a.auth.delegation.SessionTokenBinding\");\nif (!binding.isEmpty() && !known.contains(binding)) {\n  LOG.warn(\"Non-standard DT binding {} - verify it deploys credential providers\", binding);\n}","typeGuard":null,"tryCatchPattern":"try {\n  delegationTokens.start();\n} catch (DelegationTokenIOException e) {\n  if (e.getMessage().contains(\"No AWS credential providers\")) {\n    // binding deployed but produced nothing: fix or unset fs.s3a.delegation.token.binding\n    conf.unset(\"fs.s3a.delegation.token.binding\");\n    retryWithoutDelegationTokens(); // explicit fallback, not silent\n  } else {\n    throw e;\n  }\n}","preventionTips":["Prefer the standard bindings unless a custom one is fully tested","For custom bindings, unit-test that bind/deploy always yields >=1 provider","Smoke-test the full token path after changing binding config"],"tags":["aws","s3a","delegation-token","credentials","configuration"],"backgroundTag":"delegation-token-binding-misconfigured","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}