{"record":{"id":"e238d4ef30e152fa","repo":"apache/hadoop","slug":"problem-looking-up-credential-alias-in","errorCode":null,"errorMessage":"Problem looking up credential \" + alias + \" in \" + this","messagePattern":"Problem looking up credential \" \\+ alias \\+ \" in \" \\+ this","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/alias/AbstractJavaKeyStoreProvider.java","lineNumber":239,"sourceCode":"      }\n      return list;\n    } finally {\n      readLock.unlock();\n    }\n  }\n\n  @Override\n  public CredentialEntry createCredentialEntry(String alias, char[] credential)\n      throws IOException {\n    writeLock.lock();\n    try {\n      if (keyStore.containsAlias(alias)) {\n        throw new IOException(\"Credential \" + alias + \" already exists in \"\n            + this);\n      }\n      return innerSetCredential(alias, credential);\n    } catch (KeyStoreException e) {\n      throw new IOException(\"Problem looking up credential \" + alias + \" in \"\n          + this, e);\n    } finally {\n      writeLock.unlock();\n    }\n  }\n\n  @Override\n  public void deleteCredentialEntry(String name) throws IOException {\n    writeLock.lock();\n    try {\n      try {\n        if (keyStore.containsAlias(name)) {\n          keyStore.deleteEntry(name);\n        } else {\n          throw new IOException(\"Credential \" + name + \" does not exist in \"\n              + this);\n        }\n      } catch (KeyStoreException e) {","sourceCodeStart":221,"sourceCodeEnd":257,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/alias/AbstractJavaKeyStoreProvider.java#L221-L257","documentation":"Thrown by createCredentialEntry() when the pre-check keyStore.containsAlias(alias) fails with KeyStoreException. The failure is in the keystore machinery itself (uninitialized or broken KeyStore instance), not in your credential data; the alias-lookup and the create never really ran.","triggerScenarios":"The provider's KeyStore was never properly loaded/initialized (partial construction, unsupported store type in this JVM); concurrent flush/corruption left the instance unusable; custom subclass that releases the keystore early.","commonSituations":"Same situations as other KeyStoreException wrappers: empty/truncated store files, JVM upgrades mid-cluster, corrupted keystore after a crashed writer.","solutions":["Verify the store opens cleanly: keytool -list -keystore <file> -storetype jceks","Recreate the keystore if it is corrupt, then re-run the create","Confirm all nodes use a JDK that supports JCEKS and that the provider path actually points at the intended file"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"try {\n  KeyStore.getInstance(\"jceks\").load(null, null); // JVM can build a JCEKS store at all\n} catch (Exception e) {\n  throw new IllegalStateException(\"JVM cannot initialize JCEKS keystores\", e);\n}","typeGuard":null,"tryCatchPattern":"try {\n  provider.createCredentialEntry(alias, material);\n} catch (IOException ex) {\n  if (ex.getCause() instanceof java.security.KeyStoreException) {\n    // store handle broken before the create ran; rebuild provider/Configuration and retry once\n  } else { throw ex; }\n}","preventionTips":["Verify the store opens with keytool before wiring it into production config","Avoid sharing one keystore file across simultaneously writing processes"],"tags":["hadoop","credential-provider","keystore","jceks","key-store-exception"],"backgroundTag":"keystore-unavailable","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}