CREATION_005 - Could not resolve implicit EL expression when using credential function

Resolving The Problem

As previously mentioned the troubleshooting will be different depending on what kind of EL expression triggered the error. You will find more specific information in the complete error message, including what EL expression caused the error and possibly more specific error codes that will help you narrow down the issue.

In this article, we will focus on the credential functions. Here are the usual scenarios where a credential function can fail:

• Credential functions: These EL functions ( credential:get and credential:getWithOptions) are used to retrieve sensitive information stored as secrets from supported credential stores. If you get this error with these functions check the following:

  • Ensure that you have followed all the steps in our Credential Stores Documentation required to set up your specific credential store. This also applies if you have performed an update of the Datacollector. An error message that could point to a misconfiguration is one like this:
    
    Error evaluating expression ${credential:get("azure", "group@myorg", "secret")}: java.lang.RuntimeException: Undefined 'azure' credential store
    
    

  • Check that the user that started the pipeline/job is part of the <userGroup> defined in the function credential:get(<cstoreId>, <userGroup>, <name>). Especially if the full error message contains "java.lang.IllegalStateException: Not in UserGroupScope scope"
    
    

  • Check that you are using the credential:get() function in a property that allows it. You cannot use credential functions in all stages due to security reasons. For example, you cannot use credential functions in the Expression Evaluator processor. In this cases the full error might have this message:
    
    javax.servlet.jsp.el.ELException: No function is mapped to the name "credential:get"
    
    

  • If using the JKS credential store check that the credential store ownership is set to the same user that is running the program (usually sdc user), and that the Keystore is in the location defined in credential-stores.properties. Otherwise, it can produce issues.