All Products
Search

This Product

    E-MapReduce:JindoFS OSS Credential Provider

    Document Center

    E-MapReduce:JindoFS OSS Credential Provider

    Last Updated:Jul 17, 2026

    SmartData 3.4.0 and later support the JindoFS OSS Credential Provider, which encrypts and stores your AccessKey information in a file to prevent exposure.

    Limitations

    JindoRangerCredentialsProvider and AssumeRoleStsCredentialsProvider are available only in SmartData 3.8.0 and later.

    Configure the JindoFS OSS Credential Provider

    1. Navigate to the configuration page of the SmartData service.
      1. Log on to the E-MapReduce console.
      2. In the top navigation bar, select the region and resource group as required.
      3. Click the Clusters tab.
      4. On the Clusters page, click Details in the row of the target cluster.
      5. In the left-side navigation pane, click Services > SmartData.
      6. Click the Configure tab.
    2. Configure the provider by using one of the following methods.
      Configuration method Description
      Global configuration (applies to all buckets) In the configuration search box, search for the parameter fs.jfs.cache.oss.credentials.provider. Append the implementation class of AliyunCredentialsProvider to the parameter value. If you specify multiple classes, separate them with commas (,). The system tries each provider sequentially until it finds valid credentials. For more information about required parameters, see Global configuration.

      Example: com.aliyun.emr.fs.auth.TemporaryAliyunCredentialsProvider, com.aliyun.emr.fs.auth.SimpleAliyunCredentialsProvider,com.aliyun.emr.fs.auth.EnvironmentVariableCredentialsProvider.
      Bucket-level configuration To add a configuration item:
      1. On the smartdata-site tab, click Custom Configuration in the upper-right corner.
        Important For JindoRangerCredentialsProvider, you must add the custom configuration on the namespace tab.
      2. In the Add Configuration Item dialog box, set Key to fs.jfs.cache.oss.bucket.XXX.credentials.provider and Value to the implementation class of com.aliyun.emr.fs.auth.AliyunCredentialsProvider. If you specify multiple classes, separate them with commas (,). The system tries each provider sequentially until it finds valid credentials. For more information about other required parameters, see Bucket-level configuration.

        Example: com.aliyun.emr.fs.auth.TemporaryAliyunCredentialsProvider, com.aliyun.emr.fs.auth.SimpleAliyunCredentialsProvider,com.aliyun.emr.fs.auth.EnvironmentVariableCredentialsProvider.

        Note In fs.jfs.cache.oss.bucket.XXX.credentials.provider, XXX is a placeholder for the name of your OSS bucket.
      3. Click OK.
    3. Save the configuration.
      1. In the upper-right corner, click Save.
      2. In the Confirm dialog box, enter a Execution Reason, and enable Auto-update Configuration.
      3. Click OK.

    Global configuration

    Select a provider based on your requirements.

    Type Description
    TemporaryAliyunCredentialsProvider Use this provider to access OSS by using a time-bound access key and security token.
    Set the fs.jfs.cache.oss.credentials.provider parameter to com.aliyun.emr.fs.auth.TemporaryAliyunCredentialsProvider. You must also add the following parameters on the smartdata-site tab:
    • fs.jfs.cache.oss.accessKeyId: The access key ID of the OSS bucket.
    • fs.jfs.cache.oss.accessKeySecret: The access key secret of the OSS bucket.
    • fs.jfs.cache.oss.securityToken: The security token of the OSS bucket (temporary security token).
    SimpleAliyunCredentialsProvider Use this provider to access OSS by using a long-term access key.
    Set the fs.jfs.cache.oss.credentials.provider parameter to com.aliyun.emr.fs.auth.SimpleAliyunCredentialsProvider. You must also add the following parameters on the smartdata-site tab:
    • fs.jfs.cache.oss.accessKeyId: The access key ID of the OSS bucket.
    • fs.jfs.cache.oss.accessKeySecret: The access key secret of the OSS bucket.
    EnvironmentVariableCredentialsProvider Configure the following environment variables:
    • fs.jfs.cache.oss.credentials.provider: Set this parameter to com.aliyun.emr.fs.auth.EnvironmentVariableCredentialsProvider.
    • ALIYUN_ACCESS_KEY_ID: The access key ID of the OSS bucket.
    • ALIYUN_ACCESS_KEY_SECRET: The access key secret of the OSS bucket.
    • ALIYUN_SECURITY_TOKEN: The security token of the OSS bucket (temporary security token).
      Note This parameter is required only if you configure a time-bound token.
    JindoCommonCredentialsProvider This common provider, once configured, works with both JindoOSS and JindoFS.
    Set the fs.jfs.cache.oss.credentials.provider parameter to com.aliyun.emr.fs.auth.JindoCommonCredentialsProvider. You must also add the following parameters on the smartdata-site tab:
    • jindo.common.accessKeyId: The access key ID of the OSS bucket.
    • jindo.common.accessKeySecret: The access key secret of the OSS bucket.
    • jindo.common.securityToken: The security token of the OSS bucket (temporary security token).
    EcsStsCredentialsProvider This provider enables password-free access to OSS and does not require an access key.

    Set the fs.jfs.cache.oss.credentials.provider parameter to com.aliyun.emr.fs.auth.EcsStsCredentialsProvider.
    JindoRangerCredentialsProvider Use this provider to control user access to OSS through Ranger.

    Set the fs.jfs.cache.oss.credentials.provider parameter to com.aliyun.emr.fs.auth.JindoRangerCredentialsProvider. You must also add a configuration item on the namespace tab by setting the namespace.oss.permission.method parameter to ranger.

    Note After you add the custom configuration for the JindoRangerCredentialsProvider, you must restart the JindoFS Namespace Service. For more information, see Restart the JindoFS Namespace Service.
    AssumeRoleStsCredentialsProvider Use this provider to obtain a temporary access key to access OSS by assuming a RAM role.
    Set the fs.jfs.cache.oss.credentials.provider parameter to com.aliyun.emr.fs.auth.AssumeRoleStsCredentialsProvider. You must also add the following parameters on the smartdata-site tab:
    • assume.role.sts.accessKeyId: The access key ID for Alibaba Cloud Security Token Service (STS).
    • assume.role.sts.accessKeySecret: The access key secret for Alibaba Cloud STS.
    • assume.role.sts.endpoint: The endpoint for Alibaba Cloud STS. For more information, see Endpoints.
    • assume.role.roleArn: The ARN of the RAM role to assume. The format is acs:ram::$accountID:role/$roleName. For more information about how to view an ARN, see How do I view the ARN of a RAM role?
    • assume.role.roleSessionName: The role session name. This is a custom parameter, such as a username.

    Bucket-level configuration

    Select a provider based on your requirements.

    Type Description
    TemporaryAliyunCredentialsProvider Use this provider to access OSS by using a time-bound access key and security token.
    Set the fs.jfs.cache.oss.bucket.XXX.credentials.provider parameter to com.aliyun.emr.fs.auth.TemporaryAliyunCredentialsProvider. You must also add the following parameters on the smartdata-site tab:
    • fs.jfs.cache.oss.bucket.XXX.accessKeyId: The access key ID of the OSS bucket.
    • fs.jfs.cache.oss.bucket.XXX.accessKeySecret: The access key secret of the OSS bucket.
    • fs.jfs.cache.oss.bucket.XXX.securityToken: The security token of the OSS bucket (temporary security token).
    SimpleAliyunCredentialsProvider Use this provider to access OSS by using a long-term access key.
    Set the fs.jfs.cache.oss.bucket.XXX.credentials.provider parameter to com.aliyun.emr.fs.auth.SimpleAliyunCredentialsProvider. You must also add the following parameters on the smartdata-site tab:
    • fs.jfs.cache.oss.bucket.XXX.accessKeyId: The access key ID of the OSS bucket.
    • fs.jfs.cache.oss.bucket.XXX.accessKeySecret: The access key secret of the OSS bucket.
    EnvironmentVariableCredentialsProvider Configure the following environment variables:
    • fs.jfs.cache.oss.bucket.XXX.credentials.provider: Set this parameter to com.aliyun.emr.fs.auth.EnvironmentVariableCredentialsProvider.
    • ALIYUN_ACCESS_KEY_ID: The access key ID of the OSS bucket.
    • ALIYUN_ACCESS_KEY_SECRET: The access key secret of the OSS bucket.
    • ALIYUN_SECURITY_TOKEN: The security token of the OSS bucket (temporary security token).
      Note This parameter is required only if you configure a time-bound token.
    JindoCommonCredentialsProvider This common provider, once configured, works with both JindoOSS and JindoFS.
    Set the fs.jfs.cache.oss.bucket.XXX.credentials.provider parameter to com.aliyun.emr.fs.auth.JindoCommonCredentialsProvider. You must also add the following parameters on the smartdata-site tab:
    • jindo.common.accessKeyId: The access key ID of the OSS bucket.
    • jindo.common.accessKeySecret: The access key secret of the OSS bucket.
    • jindo.common.securityToken: The security token of the OSS bucket (temporary security token).
    EcsStsCredentialsProvider This provider enables password-free access to OSS and does not require an access key.

    Set the fs.jfs.cache.oss.bucket.XXX.credentials.provider parameter to com.aliyun.emr.fs.auth.EcsStsCredentialsProvider.
    JindoRangerCredentialsProvider Use this provider to control user access to OSS through Ranger.

    Set the fs.jfs.cache.oss.bucket.XXX.credentials.provider parameter to com.aliyun.emr.fs.auth.JindoRangerCredentialsProvider. You must also add a configuration item on the namespace tab by setting the namespace.oss.permission.method parameter to ranger.

    Note After you add the custom configuration for the JindoRangerCredentialsProvider, you must restart the JindoFS Namespace Service. For more information, see Restart the JindoFS Namespace Service.
    AssumeRoleStsCredentialsProvider Use this provider to obtain a temporary access key to access OSS by assuming a RAM role.
    Set the fs.jfs.cache.oss.bucket.XXX.credentials.provider parameter to com.aliyun.emr.fs.auth.AssumeRoleStsCredentialsProvider. You must also add the following parameters on the smartdata-site tab:
    • assume.role.sts.accessKeyId: The access key ID for Alibaba Cloud Security Token Service (STS).
    • assume.role.sts.accessKeySecret: The access key secret for Alibaba Cloud STS.
    • assume.role.sts.endpoint: The endpoint for Alibaba Cloud STS. For more information, see Endpoints.
    • assume.role.roleArn: The ARN of the RAM role to assume. The format is acs:ram::$accountID:role/$roleName. For more information about how to view an ARN, see How do I view the ARN of a RAM role?
    • assume.role.roleSessionName: The role session name. This is a custom parameter, such as a username.

    Restart the JindoFS Namespace Service

    After you configure the JindoRangerCredentialsProvider, you must restart the JindoFS Namespace Service.

    1. On the configuration page of the SmartData service, choose Actions > > Restart JindoFS Namespace Service in the upper-right corner.
    2. In the Cluster Activities dialog box, enter a Description and click OK.
    3. In the Confirm dialog box, click OK.