Develop Reference

Spring Boot - Config Server - Jasypt DecryptionException: Unable to decrypt: ENC()

I have a problem about running config server in my spring boot microservice example.
After I defined the dependency shown below, I tried to encrypt the password.
<dependency>
<groupId>com.github.ulisesbocchio</groupId>
<artifactId>jasypt-spring-boot-starter</artifactId>
</dependency>
Next, I want to test if it works or not through this code snippet shown below.
public static void main(String[] args) {
StandardPBEStringEncryptor standardPBEStringEncryptor = new StandardPBEStringEncryptor();
standardPBEStringEncryptor.setPassword("demo-password");
standardPBEStringEncryptor.setAlgorithm("PBEWithHMACSHA512AndAES_256");
standardPBEStringEncryptor.setIvGenerator(new RandomIvGenerator());
String result = standardPBEStringEncryptor.encrypt("spring-cloud-password");
System.out.println(result);
System.out.println(standardPBEStringEncryptor.decrypt(result));
}
Then I copied it and pasted it wrapping with ENC(encrpted-password) in yml file.
Here is the yml file shown below
spring:
application:
name: configserver
cloud:
config:
server:
git:
uri: Github-repo-address
username: Github-username
password: github-token
clone-on-start: true
default-label: main
fail-fast: true
security:
user:
name: spring-cloud-user
password: ENC(YcplhYriW9Uwo+pByJxBl04lqiQKGEIbBgVeIXn+DBITIHV9IUVenfknA2VHFswkm144fSrQRqjxZ17+g+z3GA==)
jasypt:
encryptor:
password: ${PASSWORD}
I get ${PASSWORD} from program arguments part.
Next, I run the app but I got this issue shown below.
com.ulisesbocchio.jasyptspringboot.exception.DecryptionException: Unable to decrypt: ENC(YcplhYriW9Uwo+pByJxBl04lqiQKGEIbBgVeIXn+DBITIHV9IUVenfknA2VHFswkm144fSrQRqjxZ17+g+z3GA==). Decryption of Properties failed, make sure encryption/decryption passwords match
at com.ulisesbocchio.jasyptspringboot.resolver.DefaultPropertyResolver.lambda$resolvePropertyValue$0(DefaultPropertyResolver.java:46)
at java.base/java.util.Optional.map(Optional.java:260)
at com.ulisesbocchio.jasyptspringboot.resolver.DefaultPropertyResolver.resolvePropertyValue(DefaultPropertyResolver.java:40)
at com.ulisesbocchio.jasyptspringboot.resolver.DefaultLazyPropertyResolver.resolvePropertyValue(DefaultLazyPropertyResolver.java:50)
at com.ulisesbocchio.jasyptspringboot.EncryptablePropertySource.getProperty(EncryptablePropertySource.java:20)
at com.ulisesbocchio.jasyptspringboot.caching.CachingDelegateEncryptablePropertySource.getProperty(CachingDelegateEncryptablePropertySource.java:41)
at com.ulisesbocchio.jasyptspringboot.wrapper.EncryptableMapPropertySourceWrapper.getProperty(EncryptableMapPropertySourceWrapper.java:31)
at org.springframework.cloud.bootstrap.encrypt.EnvironmentDecryptApplicationInitializer.merge(EnvironmentDecryptApplicationInitializer.java:236)
at org.springframework.cloud.bootstrap.encrypt.EnvironmentDecryptApplicationInitializer.merge(EnvironmentDecryptApplicationInitializer.java:207)
at org.springframework.cloud.bootstrap.encrypt.EnvironmentDecryptApplicationInitializer.decrypt(EnvironmentDecryptApplicationInitializer.java:189)
at org.springframework.cloud.bootstrap.encrypt.EnvironmentDecryptApplicationInitializer.initialize(EnvironmentDecryptApplicationInitializer.java:124)
at org.springframework.cloud.bootstrap.BootstrapApplicationListener$DelegatingEnvironmentDecryptApplicationInitializer.initialize(BootstrapApplicationListener.java:441)
at org.springframework.boot.SpringApplication.applyInitializers(SpringApplication.java:626)
at org.springframework.boot.SpringApplication.prepareContext(SpringApplication.java:370)
at org.springframework.boot.SpringApplication.run(SpringApplication.java:314)
at org.springframework.boot.SpringApplication.run(SpringApplication.java:1237)
at org.springframework.boot.SpringApplication.run(SpringApplication.java:1226)
at com.microservices.demo.config.server.ConfigServer.main(ConfigServer.java:11)
Caused by: org.jasypt.exceptions.EncryptionOperationNotPossibleException: null
at org.jasypt.encryption.pbe.StandardPBEByteEncryptor.decrypt(StandardPBEByteEncryptor.java:1169)
at org.jasypt.encryption.pbe.StandardPBEStringEncryptor.decrypt(StandardPBEStringEncryptor.java:738)
at org.jasypt.encryption.pbe.PooledPBEStringEncryptor.decrypt(PooledPBEStringEncryptor.java:511)
at com.ulisesbocchio.jasyptspringboot.encryptor.DefaultLazyEncryptor.decrypt(DefaultLazyEncryptor.java:57)
at com.ulisesbocchio.jasyptspringboot.resolver.DefaultPropertyResolver.lambda$resolvePropertyValue$0(DefaultPropertyResolver.java:44)
... 17 common frames omitted
How can I fix it?
Edited I passed the value as shown below
Program Arguments -> -Djasypt.encryptor.password='Demo_Pwd!2020'

1.Make sure that the jasypt.encryptor.password property in your application.yml file is set to the same value as the demo-password that you used when encrypting the spring-cloud-password in your main method.
2.Make sure that you are passing the correct value for the PASSWORD program argument when running your application.
3.Make sure that you are using the correct algorithm when encrypting and decrypting the password. In your main method, you are using the "PBEWithHMACSHA512AndAES_256" algorithm, but it's not clear if this is the same algorithm that is being used by Jasypt in your application.
4.Make sure that you are using the correct value for the encrypted password in your application.yml file. It's possible that the value you have pasted there is incorrect or has been modified in some way.

java: Error initializing PCKS11 provider getting IOException C_GetFunctionList == NULL

I'm trying to write a Java application for digitally signing documents using a bit4Id miniLector token.
I'm in a Linux development environment.
The token is correctly installed, I can sign my documents also with the app downloaded from the manufacturer, but I have to write a new one for other purposes. The driver used is located at
/usr/lib/x86_64-linux-gnu/engines-1.1/pkcs11.so
I'm stuck with this error:
/usr/lib/jvm/jdk1.8.0_111/bin/java ...
Exception in thread "main" java.security.ProviderException: Initialization failed
at sun.security.pkcs11.SunPKCS11.<init>(SunPKCS11.java:376)
at sun.security.pkcs11.SunPKCS11.<init>(SunPKCS11.java:103)
at com.itextpdf.samples.signatures.chapter02.C2_01_SignHelloWorld.main
(C2_01_SignHelloWorld.java:83)
Caused by: java.io.IOException: ERROR: C_GetFunctionList == NULL
at sun.security.pkcs11.wrapper.PKCS11.connect(Native Method)
at sun.security.pkcs11.wrapper.PKCS11.<init>(PKCS11.java:138)
at sun.security.pkcs11.wrapper.PKCS11.getInstance(PKCS11.java:151)
at sun.security.pkcs11.SunPKCS11.<init>(SunPKCS11.java:313)
... 2 more
The provider is listed in $JAVA_HOME/jre/lib/security/java.security file as:
security.provider.10=sun.security.pkcs11.SunPKCS11
The code behaving this way is this:
String configFile = "/opt/bar/cfg/pkcs11.cfg";
Provider provider = new sun.security.pkcs11.SunPKCS11(configFile); <-- line 83
The needed libraries are all imported by my IDE and I have no compile/link errors.
I didn't find this exact type of error in hours of googling.
If you need any further information let me know, any kind help is very appreciated, thanks.
For visual clarity I add all missing information with respect to the original question here below
Updates
Content of the pkcs11.cfg file:
$ cat /opt/bar/cfg/pkcs11.cfg
name="bit4id miniLector-EVO"
library=/usr/lib/x86_64-linux-gnu/engines-1.1/pkcs11.so

Ok, I got it.
The problem is the driver.
Replacing
/usr/lib/x86_64-linux-gnu/engines-1.1/pkcs11.so
with
/opt/Firma4NG/System/Firma4NG_Linux/Firma4/drivers/mu-x64/libbit4xpki.so
that is one of the manufacturer's driver, now I can go further and, for example, dumping all info about the card:
Information for provider SunPKCS11-bit4id miniLector-EVO
Library info:
cryptokiVersion: 2.20
manufacturerID: bit4id srl
flags: 0
libraryDescription: bit4id PKCS#11
libraryVersion: 1.02
...
This question can be closed.

Field length overflow in Netty SSL

I use Netty to implement a server with secure socket. My code of sslHandler is:
SslHandler sslHandler = SslContextBuilder
.forServer(certFile, keyFile)
.trustManager(trustFile)
.clientAuth(ClientAuth.REQUIRE)
.build()
.newHandler(channel.alloc());
trustFile is a File object which contains around 700 pieces of certificate text, like:
-----BEGIN CERTIFICATE-----
MIIEHDCCAwSgAwIBAgIJAOR6+3G8C6f7MA0GCSqGSIb3DQEBCwUAMIGNMQswCQYD
VQQGEwJVUzESMBAGA1UECAwJQ2FsaWZvbWlhMRwwGgYDVQQKDBNDaXNjbyBTeXN0
................................................................
igHdyc519KbYSMfhuM9gXw35LPmFWStBGYikBcMZJ1WmWxb/eZOK1SMjVQ/L/JVg
-----END CERTIFICATE-----
When I connect the server with
curl -k -v -E client.pem --key client.key.pem --cacert rootCA.pem https://10.140.28.33:31069
an exception pops up:
11:00:18.636 [nioEventLoopGroup-3-2] WARN io.netty.channel.DefaultChannelPipeline - An exceptionCaught() event was fired, and it reached at the tail of the pipeline. It usually means the last handler in the pipeline did not handle the exception.
io.netty.handler.codec.DecoderException: java.lang.RuntimeException: Field length overflow, the field length (106142) should be less than 65536
at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:459)
at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:265)
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362)
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348)
at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340)
at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1334)
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362)
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348)
at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:926)
at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:134)
at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:644)
at io.netty.channel.nio.NioEventLoop.processSelectedKeysOptimized(NioEventLoop.java:579)
at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:496)
at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:458)
at io.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:858)
at io.netty.util.concurrent.DefaultThreadFactory$DefaultRunnableDecorator.run(DefaultThreadFactory.java:138)
at java.lang.Thread.run(Thread.java:748)
Caused by: java.lang.RuntimeException: Field length overflow, the field length (106142) should be less than 65536
at sun.security.ssl.Handshaker.checkThrown(Handshaker.java:1476)
at sun.security.ssl.SSLEngineImpl.checkTaskThrown(SSLEngineImpl.java:535)
at sun.security.ssl.SSLEngineImpl.readNetRecord(SSLEngineImpl.java:813)
at sun.security.ssl.SSLEngineImpl.unwrap(SSLEngineImpl.java:781)
at javax.net.ssl.SSLEngine.unwrap(SSLEngine.java:624)
at io.netty.handler.ssl.SslHandler$SslEngineType$3.unwrap(SslHandler.java:255)
at io.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1162)
at io.netty.handler.ssl.SslHandler.decode(SslHandler.java:1084)
at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:489)
at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:428)
... 16 common frames omitted
Caused by: java.lang.RuntimeException: Field length overflow, the field length (106142) should be less than 65536
at sun.security.ssl.HandshakeOutStream.checkOverflow(HandshakeOutStream.java:231)
at sun.security.ssl.HandshakeOutStream.putInt16(HandshakeOutStream.java:163)
at sun.security.ssl.HandshakeMessage$CertificateRequest.send(HandshakeMessage.java:1442)
at sun.security.ssl.HandshakeMessage.write(HandshakeMessage.java:143)
at sun.security.ssl.ServerHandshaker.clientHello(ServerHandshaker.java:971)
at sun.security.ssl.ServerHandshaker.processMessage(ServerHandshaker.java:224)
at sun.security.ssl.Handshaker.processLoop(Handshaker.java:1026)
at sun.security.ssl.Handshaker$1.run(Handshaker.java:966)
at sun.security.ssl.Handshaker$1.run(Handshaker.java:963)
at java.security.AccessController.doPrivileged(Native Method)
at sun.security.ssl.Handshaker$DelegatedTask.run(Handshaker.java:1416)
at io.netty.handler.ssl.SslHandler.runDelegatedTasks(SslHandler.java:1301)
at io.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1214)
... 19 common frames omitted
But if I trim the trust file with only a few certificates left, no error happen.
Is it a JDK bug? How can I avoid it?

It may be a bug that JSSE doesn't give a clearer alert, but there is a fundamental problem.
When an SSL/TLS server requests client authentication, it normally sends a list of the certificate authorities the client should use in the Certificate Request message, see rfc5246 7.4.4 or earlier. Since you trust a huge number of selfsigned certs, where each selfsigner effectively acts as a CA for itself, this means your server needs to send a huge list of CAs -- but this list is limited to 65535 bytes total. Your exception shows you are trying to send 106142 bytes which doesn't fit in 65535 bytes; this means your cert names (Subjects) average about 150 bytes, which seems to me a bit on the high side if these are used entirely within your enterprise and thus presumably don't need globally unique names like the public web (especially EV with its enhanced identity requirements).
One possible workaround, if all your clients know which cert to use without being prompted, is for the server to send the CA list as empty, which is permitted though not encouraged. JSSE simply populates CertReq.CAlist from the trustmanager's getAcceptedIssuers() method, and the TrustManager API is designed for customization, so you could just wrap the real X509TrustManager with one that validates the received cert chain normally, but returns getAcceptedIssuers() as an empty array. This is fairly easy with the actual Java classes (SSLContext et amici) but I'm not sure exactly where to look in Netty's 'improvements'.
But a better solution, as noted in comments by EJP, is not to individually trust a huge number of selfsigned certs but instead have a CA issue the client certs and then the server need only trust that CA (and transitively the certs it issues) and CertReq automatically specifies only that CA. If you don't already have a suitable established CA to use, there are many options to do your own CA, discussed in other Qs here and other Stacks (IME mostly security.SX unix.SX and serverfault), but given you are using Java remember that since j7 keytool -gencert does a minimal but usable CA function. (In addition to keypair and CSR generation which keytool has done back to the dark ages.)

Jira OAuth - Unable to create application link

I am trying to create an application which uses jira for authentication. I am using Jira Rest api for the same. In the documentation it says to use the same public key and consumer-key to create application link as given in the doc. This works fine, and I am able to create access-token. But in java code as mentioned in this, I am not sure what should be given for private_key. I tried two methods-
Generated a random private key using rsa and provided it in place of private_key which didn't work. It gave exception telling length too long. I tried for 2048, 1024, 512, 256 and 128 bits. Everything gave same error.
Application link:
Consumer-key: hardcoded-consumer
Consumer Name: hardcoded-consumer
Public Key:
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxZDzGUGk6rElyPm0iOua0lWg84nOlhQN1gmTFTIu5WFyQFHZF6OA4HX7xATttQZ6N21yKMakuNdRvEudyN/coUqe89r3Ae+rkEIn4tCxGpJWX205xVF3Cgsn8ICj6dLUFQPiWXouoZ7HG0sPKhCLXXOvUXmekivtyx4bxVFD9Zy4SQ7IHTx0V0pZYGc6r1gF0LqRmGVQDaQSbivigH4mlVwoAO9Tfccf+V00hYuSvntU+B1ZygMw2rAFLezJmnftTxPuehqWu9xS5NVsPsWgBL7LOi3oY8lhzOYjbMKDWM6zUtpOmWJA52cVJW6zwxCxE28/592IARxlJcq14tjwYwIDAQAB
Generated private and public key pair and provided the same in application link and in code respectively. But in this case, I am unable to create access token. It is giving -
Application link:
Consumer-key: hardcoded-consumer
Consumer Name: hardcoded-consumer
Public Key:
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC0YjCwIfYoprq/FQO6lb3asXrx LlJFuCvtinTF5p0GxvQGu5O3gYytUvtC2JlYzypSRjVxwxrsuRcP3e641SdASwfr mzyvIgP08N4S0IFzEURkV1wp/IpH7kH41EtbmUmrXSwfNZsnQRE5SYSOhh+LcK2w yQkdgcMv11l4KoBkcwIDAQAB
Exception in thread "main" java.lang.reflect.InvocationTargetException
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:497)
at com.simontuffs.onejar.Boot.run(Boot.java:340)
at com.simontuffs.onejar.Boot.main(Boot.java:166)
Caused by: java.lang.RuntimeException: Failed to obtain request token
at com.atlassian.oauth.client.example.AtlassianOAuthClient.getRequestToken(AtlassianOAuthClient.java:66)
at com.atlassian.oauth.client.example.JIRAOAuthClient.main(JIRAOAuthClient.java:52)
... 6 more
Caused by: net.oauth.OAuthProblemException: signature_invalid
at net.oauth.client.OAuthResponseMessage.toOAuthProblemException(OAuthResponseMessage.java:83)
at net.oauth.client.OAuthClient.invoke(OAuthClient.java:306)
at net.oauth.client.OAuthClient.invoke(OAuthClient.java:260)
at net.oauth.client.OAuthClient.getRequestTokenResponse(OAuthClient.java:190)
at com.atlassian.oauth.client.example.AtlassianOAuthClient.getRequestToken(AtlassianOAuthClient.java:57)
Can someone explain me what should be done? Am I missing something here?
And also what is the difference between shared key, consumer key and public key?
Thanks in advance

The exception occurs due to ending with "/" in JIRA base URL (caused by net.oauth.OAuthProblemException: signature_invalid).
The correct request is:
java -jar rest-oauth-client-1.0.one-jar.jar requestToken https://jira_base_server_url http://your_redirctedUrl

I somehow fixed the issue by using the public that is provided in the documentation and the private key as given in the example
But still, I was unable to create an application link with private and public key generated by me.

Spring Integeration SFTP outbound gateway mget -R issue

we are trying to connect to SFTP server using spring integration [SFTP outbound-gateway] to download all files with the following directory expression '/*/*/foo/' . unfortunately we are getting different exceptions :
Caused by: org.springframework.core.NestedIOException: Failed to list files; nested exception is 2: No such file
at org.springframework.integration.sftp.session.SftpSession.list(SftpSession.java:103)
at org.springframework.integration.sftp.session.SftpSession.list(SftpSession.java:50)
at org.springframework.integration.file.remote.gateway.AbstractRemoteFileOutboundGateway.listFilesInRemoteDir(AbstractRemoteFileOutboundGateway.java:582)
at org.springframework.integration.file.remote.gateway.AbstractRemoteFileOutboundGateway.ls(AbstractRemoteFileOutboundGateway.java:551)
at org.springframework.integration.file.remote.gateway.AbstractRemoteFileOutboundGateway.mGetWithRecursion(AbstractRemoteFileOutboundGateway.java:753)
at org.springframework.integration.file.remote.gateway.AbstractRemoteFileOutboundGateway.mGet(AbstractRemoteFileOutboundGateway.java:713)
at org.springframework.integration.file.remote.gateway.AbstractRemoteFileOutboundGateway$3.doInSession(AbstractRemoteFileOutboundGateway.java:455)
at org.springframework.integration.file.remote.gateway.AbstractRemoteFileOutboundGateway$3.doInSession(AbstractRemoteFileOutboundGateway.java:451)
at org.springframework.integration.file.remote.RemoteFileTemplate.execute(RemoteFileTemplate.java:334)
... 33 more
Caused by: 2: No such file
at com.jcraft.jsch.ChannelSftp.throwStatusError(ChannelSftp.java:2833)
at com.jcraft.jsch.ChannelSftp._stat(ChannelSftp.java:2185)
at com.jcraft.jsch.ChannelSftp._stat(ChannelSftp.java:2202)
at com.jcraft.jsch.ChannelSftp.ls(ChannelSftp.java:1566)
at com.jcraft.jsch.ChannelSftp.ls(ChannelSftp.java:1527)
at org.springframework.integration.sftp.session.SftpSession.list(SftpSession.java:91)
... 41 more
we are using the following :
<int-sftp:outbound-gateway session-factory="sftpFactory" request-channel="download"
command="mget" command-options="-R" expression="'/*/*/foo/'" remote-file-separator="/"
local-directory-expression="'${local.dir}'+ #remoteDirectory" reply-channel="outputChannel"
auto-create-local-directory="true" />

Only simple wildcards are supported, such as /foo/* - meaning fetch recursively from /foo - the * is actually not needed in this case, /foo/ will do the same thing.
But, there's no way to wild-card higher level directories.
Depending on how complex your tree is, you might be able to use a custom filter instead - the filter is invoked during each recursion (where each directory is listed, filter applied, then files fetched).