{"record":{"id":"fa314b99eff9e4fa","repo":"apache/hadoop","slug":"no-credentialproviderfactory-for-in-hadoop-secu","errorCode":null,"errorMessage":"No CredentialProviderFactory for {} in hadoop.security.credential.provider.path","messagePattern":"No CredentialProviderFactory for (.+?) in hadoop\\.security\\.credential\\.provider\\.path","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/alias/CredentialProviderFactory.java","lineNumber":103,"sourceCode":"              throw new PathIOException(path,\n                  \"Recursive load of credential provider; \" +\n                      \"if loading a JCEKS file, this means that the filesystem connector is \" +\n                      \"trying to load the same file\");\n            }\n            for (CredentialProviderFactory factory : serviceLoader) {\n              CredentialProvider kp = factory.createProvider(uri, conf);\n              if (kp != null) {\n                result.add(kp);\n                found = true;\n                break;\n              }\n            }\n          } finally {\n            SERVICE_LOADER_LOCKED.set(false);\n          }\n        }\n        if (!found) {\n          throw new IOException(\"No CredentialProviderFactory for \" + uri + \" in \" +\n              CREDENTIAL_PROVIDER_PATH);\n        }\n      } catch (URISyntaxException error) {\n        throw new IOException(\"Bad configuration of \" + CREDENTIAL_PROVIDER_PATH +\n            \" at \" + path, error);\n      }\n    }\n    return result;\n  }\n}\n","sourceCodeStart":85,"sourceCodeEnd":114,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/alias/CredentialProviderFactory.java#L85-L114","documentation":"For each entry in hadoop.security.credential.provider.path, getProviders() asks every ServiceLoader-registered CredentialProviderFactory to claim the URI; if none does (found stays false), this IOException is thrown. It means the URI's scheme matches no provider implementation on the classpath - usually a typo'd scheme, a missing scheme, or the jar implementing the scheme is absent.","triggerScenarios":"Path entry with a typo'd scheme (jcekss://, jcks://); entry with no scheme at all ('/home/u/creds.jceks' parses as URI with null scheme); scheme provided by a jar not on the classpath (e.g. KMS-backed or third-party providers); META-INF/services registration missing in a shaded/relocated jar.","commonSituations":"Copy-paste typos in core-site.xml / HADOOP_CREDENTIAL_PROVIDER_PATH; assuming 'hadoop credential' supports a scheme that only exists with extra jars; upgrading Hadoop where provider SPI registration moved.","solutions":["Use a shipped scheme with exact spelling: jceks://HDFS-authority/path, jceks://file/path, localjceks://file/path, user://","For a bare filesystem path, add the scheme prefix: jceks://file/home/u/creds.jceks","If you need an extra scheme (kms://, cloud stores), add the implementing jar and check its META-INF/services/org.apache.hadoop.security.alias.CredentialProviderFactory entry","Print conf.getStringCollection(\"hadoop.security.credential.provider.path\") and eyeball every entry before debugging deeper"],"exampleFix":"# before\nexport HADOOP_CREDENTIAL_PROVIDER_PATH=/home/hadoop/creds.jceks   # no scheme -> no factory claims it\n\n# after\nexport HADOOP_CREDENTIAL_PROVIDER_PATH=jceks://file/home/hadoop/creds.jceks","handlingStrategy":"validation","validationCode":"// Validate every provider-path entry before calling getProviders()\nstatic final Set<String> KNOWN_SCHEMES = Set.of(\"jceks\", \"localjceks\", \"user\");\n\nstatic void validateProviderPath(Configuration conf) throws IOException {\n  for (String entry : conf.getStringCollection(\"hadoop.security.credential.provider.path\")) {\n    String scheme = URI.create(entry).getScheme();\n    if (scheme == null || !KNOWN_SCHEMES.contains(scheme)) {\n      throw new IOException(\"Unknown/missing provider scheme in entry: \" + entry);\n    }\n  }\n}","typeGuard":"boolean isSupportedProviderUri(String entry) {\n  String scheme = URI.create(entry).getScheme();\n  return scheme != null\n      && (\"jceks\".equals(scheme) || \"localjceks\".equals(scheme) || \"user\".equals(scheme));\n}","tryCatchPattern":"try {\n  providers = CredentialProviderFactory.getProviders(conf);\n} catch (IOException ex) {\n  if (ex.getMessage() != null && ex.getMessage().startsWith(\"No CredentialProviderFactory\")) {\n    // parse the URI out of the message, fix the scheme (typo or missing), re-run\n  } else { throw ex; }\n}","preventionTips":["Lint hadoop.security.credential.provider.path in config CI: every entry must have a known scheme","Remember shipped schemes: jceks://, localjceks://, user:// - and add extra jars for anything else","When adding a new provider jar, verify its META-INF/services registration survived shading"],"tags":["hadoop","credential-provider","uri","scheme","configuration","classpath"],"backgroundTag":"unsupported-uri-scheme","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-23T01:17:44.959Z"}