{"record":{"id":"e8fa8871b63ecd73","repo":"apache/hadoop","slug":"cannot-find-password-option","errorCode":null,"errorMessage":"Cannot find password option {}","messagePattern":"Cannot find password option (.+?)","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"hadoop-cloud-storage-project/hadoop-huaweicloud/src/main/java/org/apache/hadoop/fs/obs/OBSCommonUtils.java","lineNumber":1227,"sourceCode":"      final String key, final String val) throws IOException {\n    return StringUtils.isEmpty(val) ? lookupPassword(conf, key) : val;\n  }\n\n  /**\n   * Get a password from a configuration/configured credential providers.\n   *\n   * @param conf configuration\n   * @param key  key to look up\n   * @return a password or the value in {@code defVal}\n   * @throws IOException on any problem\n   */\n  private static String lookupPassword(final Configuration conf,\n      final String key) throws IOException {\n    try {\n      final char[] pass = conf.getPassword(key);\n      return pass != null ? new String(pass).trim() : \"\";\n    } catch (IOException ioe) {\n      throw new IOException(\"Cannot find password option \" + key, ioe);\n    }\n  }\n\n  /**\n   * String information about a summary entry for debug messages.\n   *\n   * @param summary summary object\n   * @return string value\n   */\n  static String stringify(final ObsObject summary) {\n    return summary.getObjectKey() + \" size=\" + summary.getMetadata()\n        .getContentLength();\n  }\n\n  /**\n   * Get a integer option not smaller than the minimum allowed value.\n   *\n   * @param conf   configuration","sourceCodeStart":1209,"sourceCodeEnd":1245,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-cloud-storage-project/hadoop-huaweicloud/src/main/java/org/apache/hadoop/fs/obs/OBSCommonUtils.java#L1209-L1245","documentation":"OBSCommonUtils.lookupPassword(conf, key) calls conf.getPassword(key) — the Hadoop credential-provider-aware accessor — and wraps any IOException it throws as IOException('Cannot find password option <key>'). The underlying failure is almost never a missing value (getPassword returns null for that); it is a broken credential provider configuration, e.g. a malformed or unreadable provider in hadoop.security.credential.provider.path (or fs.obs.security.credential.provider.path) that throws when the password needs to be resolved.","triggerScenarios":"hadoop.security.credential.provider.path contains a jceks:// URL whose file does not exist or has wrong permissions; a localjceks/JavaKeyStoreProvider with a corrupt store; an HadoopKMS provider unreachable/misconfigured; password stored under a different alias than the key being looked up so a failing provider still gets consulted.","commonSituations":"Migrating secrets to credential providers at upgrade time; cluster nodes where the .jceks file was distributed with restrictive ownership (only deployed user can read); alias typos like fs.obs.secet.key; mixing per-bucket fs.obs.bucket.X.security.credential.provider.path overrides pointing at stale locations.","solutions":["Validate the provider chain: hadoop credential list -provider jceks://file/... and confirm the store file exists, is readable by the running user on EVERY node.","Re-create the entry: hadoop credential create fs.obs.secret.key -provider jceks://file/user/... and re-distribute with correct ownership/permissions.","Check the alias matches the option key exactly (fs.obs.secret.key; per-bucket variants use the bucket-qualified name).","If you do not use credential providers, ensure the provider path config is empty/valid and supply AK/SK via fs.obs.access.key / fs.obs.secret.key or env vars so getPassword never consults a broken provider."],"exampleFix":"# before\n# hadoop.security.credential.provider.path = jceks://file/opt/secrets/obs.jceks\n# (file missing on workers) -> Cannot find password option fs.obs.secret.key\n\n# after\nhadoop credential create fs.obs.secret.key \\\n  -provider jceks://file/opt/secrets/obs.jceks\n# distribute with correct perms:\n#   chown hdfs:hdfs /opt/secrets/obs.jceks; chmod 440 /opt/secrets/obs.jceks","handlingStrategy":"validation","validationCode":"static void verifyCredentialProvider(Configuration conf) throws IOException {\n  String path = conf.get(\"hadoop.security.credential.provider.path\", \"\");\n  for (String entry : path.split(\",\")) {\n    if (entry.startsWith(\"jceks://file\")) {\n      java.io.File f = new java.io.File(entry.substring(\"jceks://file\".length()));\n      if (!f.canRead()) throw new IOException(\"unreadable credential store: \" + f);\n    }\n  }\n}","typeGuard":null,"tryCatchPattern":"try {\n  obsFs.initialize(uri, conf);\n} catch (IOException e) {\n  if (String.valueOf(e.getMessage()).startsWith(\"Cannot find password option\")) {\n    throw new ConfigException(\"credential provider chain broken — check provider path/perms/alias\", e);\n  }\n  throw e;\n}","preventionTips":["Run 'hadoop credential list -provider ...' as a cluster bootstrap check.","Distribute .jceks files with strict ownership (running user) and mode 440/400.","Keep alias names exactly equal to the option keys; add a config-lint that cross-checks aliases.","Do not confuse: a missing value returns null (no throw); a throwing provider is a broken provider."],"tags":["obs","huaweicloud","credentials","credential-provider","jceks"],"backgroundTag":"missing-credential-provider","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-23T01:17:44.959Z"}