pentaho/pentaho-kettle · error · KettleException

RandomValue.Log.SecretKeyNull

Error message

RandomValue.Log.SecretKeyNull

What it means

RandomValue.generateRandomMACHash throws when the secret key (SecretKey) needed to build the HMAC Mac instance is null. The selected random-value function requires an HMAC key (e.g. random HMAC SHA-256 generator types), and none was supplied or derivable from the password/variable, so no MAC can be initialized.

Solutions

1. Set the secret key field/password in the Random Value step configuration
2. Ensure the variable used for the key is defined at runtime (check setVariables/kettle.properties)
3. If deriving the key programmatically, pass a non-null SecretKey to getRandomValue

Example fix

// before
SecretKey sk = resolveKey(variables.getVariable("HMAC_KEY")); // null if unset
Mac mac = Mac.getInstance(sk.getAlgorithm());
// after
String keyStr = variables.getVariable("HMAC_KEY");
if (keyStr == null || keyStr.isEmpty()) {
  throw new KettleException("RandomValue HMAC key variable HMAC_KEY is not set");
}
SecretKey sk = new SecretKeySpec(keyStr.getBytes(StandardCharsets.UTF_8), "HmacSHA256");
Mac mac = Mac.getInstance(sk.getAlgorithm());

SecretKey sk = resolveSecretKey();
if (sk == null || sk.getEncoded() == null || sk.getEncoded().length == 0) {
  throw new IllegalArgumentException("HMAC secret key must be configured for this random value function");
}

boolean hasSecretKey(SecretKey sk) { return sk != null && sk.getAlgorithm() != null && sk.getEncoded() != null && sk.getEncoded().length > 0; }

try { String v = getRandomValue(...); } catch (KettleException e) { if (e.getMessage().contains("SecretKeyNull")) { logError("HMAC key missing — set the key variable or step field"); } throw e; }

When it happens

Trigger: Using a Random Value step with an HMAC-type function while no secret key is configured — the key field/password resolves to null at runtime (empty variable, unset environment substitution, or null passed to getRandomValue).

Common situations: HMAC generator configured in a cluster/agent environment where the key variable isn't set; user typed key in wrong field; migrating metadata where the password field was not exported.

Related errors

• AccessInput.Exception.CouldnotFindField
• AccessInput.Log.NoField
• AddSequence.Exception.NoSpecifiedMethod
• At this time we don't support the use of multiple cluster…
• AutoDoc.Exception.FilenameFieldNotFound

AI-assisted analysis of pentaho/pentaho-kettle@f3058517a1 (2026-09-13). Data as JSON: /api/errors/3410565cc15e79ba. Report an issue: GitHub.

Appendix: source

Thrown at engine/src/main/java/org/pentaho/di/trans/steps/randomvalue/RandomValue.java:121

    return row;
  }

  private String generateRandomMACHash( int algorithm ) throws Exception {
    // Generates a secret key
    SecretKey sk = null;
    switch ( algorithm ) {
      case RandomValueMeta.TYPE_RANDOM_MAC_HMACMD5:
        sk = data.keyGenHmacMD5.generateKey();
        break;
      case RandomValueMeta.TYPE_RANDOM_MAC_HMACSHA1:
        sk = data.keyGenHmacSHA1.generateKey();
        break;
      default:
        break;
    }

    if ( sk == null ) {
      throw new KettleException( BaseMessages.getString( PKG, "RandomValue.Log.SecretKeyNull" ) );
    }

    // Create a MAC object using HMAC and initialize with key
    Mac mac = Mac.getInstance( sk.getAlgorithm() );
    mac.init( sk );
    // digest
    byte[] hashCode = mac.doFinal();
    StringBuilder encoded = new StringBuilder();
    for ( int i = 0; i < hashCode.length; i++ ) {
      String _b = Integer.toHexString( hashCode[i] );
      if ( _b.length() == 1 ) {
        _b = "0" + _b;
      }
      encoded.append( _b.substring( _b.length() - 2 ) );
    }

    return encoded.toString();

View on GitHub (pinned to f3058517a1)