{"record":{"id":"fabdf0861658ba85","repo":"apache/iceberg","slug":"creating-bigquery-client-failed-due-to-a-security","errorCode":null,"errorMessage":"Creating BigQuery client failed due to a security issue","messagePattern":"Creating BigQuery client failed due to a security issue","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"bigquery/src/main/java/org/apache/iceberg/gcp/bigquery/BigQueryMetastoreCatalog.java","lineNumber":92,"sourceCode":"  public BigQueryMetastoreCatalog() {}\n\n  @Override\n  public void initialize(String name, Map<String, String> properties) {\n\n    BigQueryProperties bigQueryProperties = new BigQueryProperties(properties);\n\n    this.projectId = bigQueryProperties.projectId();\n    this.projectLocation = bigQueryProperties.location();\n    this.listAllTables = bigQueryProperties.listAllTables();\n\n    BigQueryOptions bigQueryOptions = bigQueryProperties.metastoreOptions();\n\n    try {\n      client = new BigQueryMetastoreClientImpl(bigQueryOptions);\n    } catch (IOException e) {\n      throw new UncheckedIOException(\"Creating BigQuery client failed\", e);\n    } catch (GeneralSecurityException e) {\n      throw new RuntimeException(\"Creating BigQuery client failed due to a security issue\", e);\n    }\n\n    initialize(name, properties, projectId, projectLocation, client);\n  }\n\n  @VisibleForTesting\n  void initialize(\n      String name,\n      Map<String, String> properties,\n      String initialProjectId,\n      String initialLocation,\n      BigQueryMetastoreClient bigQueryMetaStoreClient) {\n    Preconditions.checkArgument(bigQueryMetaStoreClient != null, \"Invalid BigQuery client: null\");\n    this.catalogName = name;\n    this.catalogProperties = ImmutableMap.copyOf(properties);\n    this.projectId = initialProjectId;\n    this.projectLocation = initialLocation;\n    this.client = bigQueryMetaStoreClient;","sourceCodeStart":74,"sourceCodeEnd":110,"githubUrl":"https://github.com/apache/iceberg/blob/86d9c8fc543e7c56c9f624eb725f76c9baff9570/bigquery/src/main/java/org/apache/iceberg/gcp/bigquery/BigQueryMetastoreCatalog.java#L74-L110","documentation":"If constructing the BigQuery metastore client throws GeneralSecurityException (typically credential/key handling problems), initialize() wraps it in a RuntimeException stating the client creation failed due to a security issue.","triggerScenarios":"new BigQueryMetastoreClientImpl(bigQueryOptions) throws GeneralSecurityException — usually invalid, malformed, or unloadable Google credentials (bad service account key, wrong scope setup).","commonSituations":"Corrupted or wrong-format service account JSON key; using an OAuth client secret where a service account key is expected; missing/incorrect scopes; expired or revoked key.","solutions":["Inspect the wrapped GeneralSecurityException cause for the credential problem.","Regenerate the service account key and point the config at the new valid JSON key file.","Verify the credential file is a service account key (not an OAuth client secret) and is valid JSON.","Ensure required scopes and enabled APIs (BigQuery API) on the project."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// verify credentials load before creating the catalog client\nGoogleCredentials credentials = ServiceAccountCredentials.fromStream(new FileInputStream(keyPath));","typeGuard":null,"tryCatchPattern":"try { catalog.initialize(name, props); } catch (RuntimeException e) { if (e.getMessage().contains(\"security issue\")) { log.error(\"Check Google credentials: {}\", e.getCause()); } throw e; }","preventionTips":["Use a valid, non-expired service account JSON key (not an OAuth client secret).","Load and validate credentials with the Google auth library before catalog init.","Ensure the BigQuery API is enabled and the key has the right roles on the project."],"tags":["gcp","bigquery","security","credentials"],"backgroundTag":"authentication-required","analyzedSha":"86d9c8fc543e7c56c9f624eb725f76c9baff9570","analyzedAt":"2026-09-12T00:46:39.097Z","contentChangedAt":"2026-09-12T00:46:39.097Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}