{"record":{"id":"e1b8de98ae66364b","repo":"apache/hadoop","slug":"bad-configuration-of-hadoop-security-key-provider","errorCode":null,"errorMessage":"Bad configuration of hadoop.security.key.provider.path at ${path}","messagePattern":"Bad configuration of hadoop\\.security\\.key\\.provider\\.path at (.+?)","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/KeyProviderFactory.java","lineNumber":76,"sourceCode":"      iterServices.next();\n    }\n  }\n  \n  public static List<KeyProvider> getProviders(Configuration conf\n                                               ) throws IOException {\n    List<KeyProvider> result = new ArrayList<KeyProvider>();\n    for(String path: conf.getStringCollection(KEY_PROVIDER_PATH)) {\n      try {\n        URI uri = new URI(path);\n        KeyProvider kp = get(uri, conf);\n        if (kp != null) {\n          result.add(kp);\n        } else {\n          throw new IOException(\"No KeyProviderFactory for \" + uri + \" in \" +\n              KEY_PROVIDER_PATH);\n        }\n      } catch (URISyntaxException error) {\n        throw new IOException(\"Bad configuration of \" + KEY_PROVIDER_PATH +\n            \" at \" + path, error);\n      }\n    }\n    return result;\n  }\n\n  /**\n   * Create a KeyProvider based on a provided URI.\n   *\n   * @param uri key provider URI\n   * @param conf configuration to initialize the key provider\n   * @return the key provider for the specified URI, or <code>NULL</code> if\n   *         a provider for the specified URI scheme could not be found.\n   * @throws IOException thrown if the provider failed to initialize.\n   */\n  public static KeyProvider get(URI uri, Configuration conf)\n      throws IOException {\n    KeyProvider kp = null;","sourceCodeStart":58,"sourceCodeEnd":94,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/KeyProviderFactory.java#L58-L94","documentation":"An entry in hadoop.security.key.provider.path could not be parsed by new URI(path) - a URISyntaxException - so the provider chain cannot even be constructed; the wrapping IOException names both the property and the offending value. Causes are literal syntax problems in the URI, not missing providers.","triggerScenarios":"Unencoded spaces or illegal characters in file paths (space must be %20); stray quotes, semicolons or whitespace introduced while editing core-site.xml; malformed scheme parts like '://host' with no scheme.","commonSituations":"Windows or human-friendly paths pasted into provider config unencoded; XML property values copied from docs with smart quotes; shell variable interpolation leaving junk characters.","solutions":["URL-encode illegal characters in the URI (space -> %20, '[' ']' -> %5B %5D)","Remove stray quotes, whitespace and separators introduced during config editing","Validate each entry up front with new URI(value) or `hadoop key list -provider <value>`"],"exampleFix":"<!-- before -->\n<value>jceks://file/my keys/keystore.jceks</value>\n\n<!-- after -->\n<value>jceks://file/my%20keys/keystore.jceks</value>","handlingStrategy":"validation","validationCode":"for (String entry : conf.getStringCollection(\"hadoop.security.key.provider.path\")) {\n  try { new URI(entry); } // preflight parse\n  catch (URISyntaxException e) {\n    throw new IllegalArgumentException(\"bad provider path entry '\" + entry + \"': \" + e.getMessage(), e);\n  }\n}","typeGuard":null,"tryCatchPattern":"try { KeyProviderFactory.getProviders(conf); } catch (IOException e) { if (e.getCause() instanceof URISyntaxException) { // fix/encode the offending entry from the message, then reload config } else { throw e; } }","preventionTips":["URL-encode spaces (%20) and brackets in provider URIs","Lint core-site.xml provider values in CI with a URI parse check","Avoid smart quotes/copy artifacts when pasting provider paths"],"tags":["java","hadoop","key-provider","configuration","uri","validation"],"backgroundTag":"invalid-uri-config","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}