diff --git a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/LdapGroupsMapping.java b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/LdapGroupsMapping.java
index 0369d2144d4..78f9ff794f5 100644
--- a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/LdapGroupsMapping.java
+++ b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/LdapGroupsMapping.java
@@ -398,19 +398,15 @@ public class LdapGroupsMapping
   }
 
   String getPassword(Configuration conf, String alias, String defaultPass) {
-    String password = null;
+    String password = defaultPass;
     try {
       char[] passchars = conf.getPassword(alias);
       if (passchars != null) {
         password = new String(passchars);
       }
-      else {
-        password = defaultPass;
-      }
-    }
-    catch (IOException ioe) {
-      LOG.warn("Exception while trying to password for alias " + alias + ": "
-          + ioe.getMessage());
+    } catch (IOException ioe) {
+      LOG.warn("Exception while trying to get password for alias " + alias
+              + ": ", ioe);
     }
     return password;
   }
diff --git a/hadoop-common-project/hadoop-common/src/test/java/org/apache/hadoop/security/TestLdapGroupsMapping.java b/hadoop-common-project/hadoop-common/src/test/java/org/apache/hadoop/security/TestLdapGroupsMapping.java
index 0a448b4de1e..c9324bd368f 100644
--- a/hadoop-common-project/hadoop-common/src/test/java/org/apache/hadoop/security/TestLdapGroupsMapping.java
+++ b/hadoop-common-project/hadoop-common/src/test/java/org/apache/hadoop/security/TestLdapGroupsMapping.java
@@ -52,6 +52,7 @@ import org.junit.Assert;
 import org.junit.Before;
 import org.junit.Test;
 
+import org.mockito.Mockito;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -314,4 +315,23 @@ public class TestLdapGroupsMapping extends TestLdapGroupsMappingBase {
     }
   }
 
+  /**
+   * Make sure that when
+   * {@link Configuration#getPassword(String)} throws an IOException,
+   * {@link LdapGroupsMapping#setConf(Configuration)} does not throw an NPE.
+   *
+   * @throws Exception
+   */
+  @Test(timeout = 10000)
+  public void testSetConf() throws Exception {
+    Configuration conf = new Configuration();
+    Configuration mockConf = Mockito.spy(conf);
+    when(mockConf.getPassword(anyString()))
+        .thenThrow(new IOException("injected IOException"));
+    // Set a dummy LDAP server URL.
+    mockConf.set(LdapGroupsMapping.LDAP_URL_KEY, "ldap://test");
+
+    mappingSpy.setConf(mockConf);
+  }
+
 }