Spring Cloud Config not decrypting the config server password

user_4077983 0
Viewed 16781

I've been working on Spring Cloud Config for a while. I have a requirement of securing the config data. As per Spring Cloud Documentation I have configured the server.jks and added to classpath. Now I am able to encrypt and decrypt remote config data.

For making the config server secure I have added Spring Security Starter and assigned credentials (password decrypted). For some reason the application is throwing exceptions that it does not have key store on the classpath. After googling it for a while I found that the keystore should go to bootstrap.yml instead of application.yml. This is also not working, what am I missing here?

You can find the yml config files on GitHub: SpringConfigData

Exception:

java.lang.IllegalStateException: Cannot decrypt: key=security.user.password
    at org.springframework.cloud.bootstrap.encrypt.EnvironmentDecryptApplicationInitializer.decrypt(EnvironmentDecryptApplicationInitializer.java:195) ~[spring-cloud-context-1.1.0.BUILD-SNAPSHOT.jar:1.1.0.BUILD-SNAPSHOT]
    at org.springframework.cloud.bootstrap.encrypt.EnvironmentDecryptApplicationInitializer.decrypt(EnvironmentDecryptApplicationInitializer.java:164) ~[spring-cloud-context-1.1.0.BUILD-SNAPSHOT.jar:1.1.0.BUILD-SNAPSHOT]
    at org.springframework.cloud.bootstrap.encrypt.EnvironmentDecryptApplicationInitializer.initialize(EnvironmentDecryptApplicationInitializer.java:94) ~[spring-cloud-context-1.1.0.BUILD-SNAPSHOT.jar:1.1.0.BUILD-SNAPSHOT]
    at org.springframework.cloud.bootstrap.BootstrapApplicationListener$DelegatingEnvironmentDecryptApplicationInitializer.initialize(BootstrapApplicationListener.java:333) ~[spring-cloud-context-1.1.0.BUILD-SNAPSHOT.jar:1.1.0.BUILD-SNAPSHOT]
    at org.springframework.boot.SpringApplication.applyInitializers(SpringApplication.java:640) [spring-boot-1.3.3.RELEASE.jar:1.3.3.RELEASE]
    at org.springframework.boot.SpringApplication.createAndRefreshContext(SpringApplication.java:343) [spring-boot-1.3.3.RELEASE.jar:1.3.3.RELEASE]
    at org.springframework.boot.SpringApplication.run(SpringApplication.java:307) [spring-boot-1.3.3.RELEASE.jar:1.3.3.RELEASE]
    at org.springframework.boot.SpringApplication.run(SpringApplication.java:1191) [spring-boot-1.3.3.RELEASE.jar:1.3.3.RELEASE]
    at org.springframework.boot.SpringApplication.run(SpringApplication.java:1180) [spring-boot-1.3.3.RELEASE.jar:1.3.3.RELEASE]
    at com.test.TestConfigServerApplication.main(TestConfigServerApplication.java:12) [classes/:na]
Caused by: java.lang.UnsupportedOperationException: No decryption for FailsafeTextEncryptor. Did you configure the keystore correctly?
    at org.springframework.cloud.bootstrap.encrypt.EncryptionBootstrapConfiguration$FailsafeTextEncryptor.decrypt(EncryptionBootstrapConfiguration.java:151) ~[spring-cloud-context-1.1.0.BUILD-SNAPSHOT.jar:1.1.0.BUILD-SNAPSHOT]
    at org.springframework.cloud.bootstrap.encrypt.EnvironmentDecryptApplicationInitializer.decrypt(EnvironmentDecryptApplicationInitializer.java:187) ~[spring-cloud-context-1.1.0.BUILD-SNAPSHOT.jar:1.1.0.BUILD-SNAPSHOT]
    ... 9 common frames omitted
spring-cloud spring-boot
6 Answers

I have had this problem. To set symmetric encryption in the latest versions of spring cloud, you just have to set the encrypt.key property in the bootstap.yml(or .properties) with the required key (it is recommended to set the key as an OS environmental variable and reference the variable in your file. This is for more security)

However, as you discovered the properties in the bootsrap file are no more imported. You must add the following dependency into your pom file for the properties in that file to be loaded:

<dependency>
      <groupId>org.springframework.cloud</groupId>
      <artifactId>spring-cloud-starter-bootstrap</artifactId>
</dependency>

After having done this every thing will work smoothly.

user_132713330 
<dependency>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-rsa</artifactId>
    <version>1.0.8.RELEASE</version>
</dependency>

I was facing the same problem from the config client side. To resolve this, I added this dependency in the pom.xml and in bootstarp.properties/bootstrap.yml file, I added encrypt.key property as I was using symmetric encryption.

hope it helps.

user_98879570

I experienced this error because my application was taking local bootstrap.yml instead of cloud config in the server. That's why it cannot decrypt and it fails.

Make sure local bootstrap.yml has this prop, which indicates to use config.uri to read the config from the server instead:

spring:
  cloud:
    config:
      enabled: true
user_35307070

Simple answer is: move all properties from bootstrap.yaml to application.yaml.

user_6911830

I had into this problem when I ran projects in IntelliJ IDEA and had the following project structure:

.
├── config
│   └── application.yaml
├── api-users
│   ├── pom.xml
│   └── src
└── config-server
    ├── pom.xml
    └── src

The project also used the file config/application.yaml when it was launched, which is why this error occurred.

After renaming the config directory to configuration, this problem was resolved.

user_90610080
Related