{"record":{"id":"ffdaed5ccb2d6e9e","repo":"t8y2/dbx","slug":"hive-storepasswordpath-uses-the-java-hadoop-creden-ffdaed","errorCode":null,"errorMessage":"Hive storePasswordPath uses the Java Hadoop credential-provider format; configure keyStorePassword explicitly for the native agent","messagePattern":"Hive storePasswordPath uses the Java Hadoop credential-provider format; configure keyStorePassword explicitly for the native agent","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/hive-go/config.go","lineNumber":1099,"sourceCode":"\t\tfor _, certificate := range certificates {\n\t\t\tcustomRoots.AddCert(certificate)\n\t\t}\n\t}\n\tconfig.RootCAs = customRoots\n\tif params.ClientCertPath != \"\" || params.ClientKeyPath != \"\" {\n\t\tif params.ClientCertPath == \"\" || params.ClientKeyPath == \"\" {\n\t\t\treturn nil, errors.New(\"Hive client certificate and key must be configured together\")\n\t\t}\n\t\tcertificate, err := tls.LoadX509KeyPair(params.ClientCertPath, params.ClientKeyPath)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"load Hive client certificate: %w\", err)\n\t\t}\n\t\tconfig.Certificates = []tls.Certificate{certificate}\n\t}\n\tkeyStoreLocation := parameter(values, \"sslkeystore\")\n\tif keyStoreLocation != \"\" {\n\t\tif parameter(values, \"keystorepassword\") == \"\" && credentialProviderPath != \"\" {\n\t\t\treturn nil, errors.New(\"Hive storePasswordPath uses the Java Hadoop credential-provider format; configure keyStorePassword explicitly for the native agent\")\n\t\t}\n\t\tcertificate, err := loadClientKeyStore(\n\t\t\tkeyStoreLocation,\n\t\t\tparameter(values, \"keystorepassword\"),\n\t\t\tparameter(values, \"keystoretype\"),\n\t\t)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"load Hive keystore: %w\", err)\n\t\t}\n\t\tconfig.Certificates = append(config.Certificates, certificate)\n\t}\n\tif parameterBool(values, \"twoway\") {\n\t\tif keyStoreLocation == \"\" && len(config.Certificates) == 0 {\n\t\t\treturn nil, errors.New(\"Hive two-way TLS requires sslKeyStore or a client certificate\")\n\t\t}\n\t\tif trustStoreLocation == \"\" && config.RootCAs == nil {\n\t\t\treturn nil, errors.New(\"Hive two-way TLS requires sslTrustStore or a CA certificate\")\n\t\t}","sourceCodeStart":1081,"sourceCodeEnd":1117,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/hive-go/config.go#L1081-L1117","documentation":"Same as the trust-store case but for the client keystore: when sslKeyStore is configured and no keystorepassword parameter is given while a Java Hadoop credential-provider (storePasswordPath) style path is present, the native agent cannot resolve the password and rejects the config. The Java credential-provider format is unsupported in Go.","triggerScenarios":"Connection params include sslKeyStore, no keystorepassword, and a storePasswordPath in the Hadoop credential-provider format (e.g. jceks://...), usually migrated from a Java Hive JDBC URL.","commonSituations":"Porting Java JDBC connection strings to the native agent; enterprise tooling auto-generating configs with credential-provider passwords.","solutions":["Set the keystorepassword parameter explicitly.","Extract the password from the JCEKS credential provider once and put it in the config.","Convert the client key/cert to PEM and use ClientCertPath/ClientKeyPath instead of a Java keystore."],"exampleFix":"// before\n// sslKeyStore=/etc/certs/client.jks, storePasswordPath=jceks://hdfs/secrets/kpass\n// after\n// sslKeyStore=/etc/certs/client.jks, keyStorePassword=changeit","handlingStrategy":"validation","validationCode":"if params[\"sslkeystore\"] != \"\" && params[\"keystorepassword\"] == \"\" &&\n\tstrings.HasPrefix(params[\"storepasswordpath\"], \"jceks://\") {\n\treturn fmt.Errorf(\"native agent needs an explicit keyStorePassword, not a Hadoop credential provider\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Provide keystorepassword explicitly for Java keystores","Prefer PEM client certs/keys over JKS keystores in Go agents","Strip credential-provider paths when porting Java connection strings"],"tags":["tls","keystore","config","migration"],"backgroundTag":"java-credential-provider-unsupported","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}