t8y2/dbx · error

Hive storePasswordPath uses the Java Hadoop credential-provi

Error message

Hive storePasswordPath uses the Java Hadoop credential-provider format; configure keyStorePassword explicitly for the native agent

What it means

Same as the trust-store case but for the client keystore: when sslKeyStore is configured and no keystorepassword parameter is given while a Java Hadoop credential-provider (storePasswordPath) style path is present, the native agent cannot resolve the password and rejects the config. The Java credential-provider format is unsupported in Go.

Source

Thrown at agents/drivers/hive-go/config.go:1099

		for _, certificate := range certificates {
			customRoots.AddCert(certificate)
		}
	}
	config.RootCAs = customRoots
	if params.ClientCertPath != "" || params.ClientKeyPath != "" {
		if params.ClientCertPath == "" || params.ClientKeyPath == "" {
			return nil, errors.New("Hive client certificate and key must be configured together")
		}
		certificate, err := tls.LoadX509KeyPair(params.ClientCertPath, params.ClientKeyPath)
		if err != nil {
			return nil, fmt.Errorf("load Hive client certificate: %w", err)
		}
		config.Certificates = []tls.Certificate{certificate}
	}
	keyStoreLocation := parameter(values, "sslkeystore")
	if keyStoreLocation != "" {
		if parameter(values, "keystorepassword") == "" && credentialProviderPath != "" {
			return nil, errors.New("Hive storePasswordPath uses the Java Hadoop credential-provider format; configure keyStorePassword explicitly for the native agent")
		}
		certificate, err := loadClientKeyStore(
			keyStoreLocation,
			parameter(values, "keystorepassword"),
			parameter(values, "keystoretype"),
		)
		if err != nil {
			return nil, fmt.Errorf("load Hive keystore: %w", err)
		}
		config.Certificates = append(config.Certificates, certificate)
	}
	if parameterBool(values, "twoway") {
		if keyStoreLocation == "" && len(config.Certificates) == 0 {
			return nil, errors.New("Hive two-way TLS requires sslKeyStore or a client certificate")
		}
		if trustStoreLocation == "" && config.RootCAs == nil {
			return nil, errors.New("Hive two-way TLS requires sslTrustStore or a CA certificate")
		}

View on GitHub (pinned to c0390bff16)

Solutions

1. Set the keystorepassword parameter explicitly.
2. Extract the password from the JCEKS credential provider once and put it in the config.
3. Convert the client key/cert to PEM and use ClientCertPath/ClientKeyPath instead of a Java keystore.

Example fix

// before
// sslKeyStore=/etc/certs/client.jks, storePasswordPath=jceks://hdfs/secrets/kpass
// after
// sslKeyStore=/etc/certs/client.jks, keyStorePassword=changeit

if params["sslkeystore"] != "" && params["keystorepassword"] == "" &&
	strings.HasPrefix(params["storepasswordpath"], "jceks://") {
	return fmt.Errorf("native agent needs an explicit keyStorePassword, not a Hadoop credential provider")
}

When it happens

Trigger: Connection params include sslKeyStore, no keystorepassword, and a storePasswordPath in the Hadoop credential-provider format (e.g. jceks://...), usually migrated from a Java Hive JDBC URL.

Common situations: Porting Java JDBC connection strings to the native agent; enterprise tooling auto-generating configs with credential-provider passwords.

Related errors

• Hive storePasswordPath uses the Java Hadoop credential-provi
• load Hive keystore: %w
• load ZooKeeper keystore: %w
• unsupported store type %q
• Hive CA certificate contains no certificates

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/ffdaed5ccb2d6e9e. Report an issue: GitHub.