[NIFI-4237] EncryptionOperationNotPossibleException in nifi-bootstrap.log might suggest underlying cause

• Type: Bug
• Status: Resolved
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 1.3.0
• Fix Version/s: 1.4.0
• Component/s: Core Framework
• Labels: encryption logging security
• Assignee: Andy LoPresto
• Reporter: Russell Bateman
• Created: 28/Jul/17 16:43
• Updated: 12/Aug/17 12:29
• Resolved: 12/Aug/17 04:14

Description

Our Ansible instructions upgraded NiFi and created a new nifi.sensitive.props.key. In nifi.properties this property, if extant, is used to encrypt sensitive properties in flow.xml.gz. Thus, upon relaunching NiFi, the wrong key was used to decrypt resulting in the reported failure to start, flow.xml.gz is no longer useful.

We found the problem and fixed it after Mark Payne suggested a possible cause, but if this state of things can be determined, it might save on community support for this situation if the logged message were to suggest what's at the bottom of this problem. The top of the stack trace appears in logs/nifi-app.log as below:

2017-07-25 23:23:31,148 WARN [main] org.apache.nifi.web.server.JettyServer
Failed to start web server... shutting down.
org.apache.nifi.encrypt.EncryptionException:
org.jasypt.exceptions.EncryptionOperationNotPossibleException
at
org.apache.nifi.encrypt.StringEncryptor.decrypt(StringEncryptor.java:149)
~[nifi-framework-core-1.1.2.jar:1.1.2]
at
org.apache.nifi.controller.serialization.FlowFromDOMFactory.decrypt(FlowFromDOMFactory.java:474)
~[nifi-framework-core-1.1.2.jar:1.1.2]
at...

Issue Links

• is related to: NIFI-3116 Remove Jasypt library
• links to: GitHub Pull Request #2077