SYSTEM IMPORT: Import System Export Encryption Issue

Importing an Encrypted System Export Runs into Key Issues

Artifactory has a handful of keys that encrypt the different configuration files.  The one that causes issues with the import/export is the artifactory.key.  This encryption for this specific key can be activated and deactivated with the following two REST API calls.

Artifactory rest APIs

Activate Artifactory key encryption

Deactivate Artifactory key encryption 

The issue that arises when running the import

If we take a System Export of an encrypted environment, there is a real possibility we will run into issues on the import.  This artifactory.key is used to encrypt passwords within the artifactory.config.xml that is included within the export.  When we run one of these exports, we see the following error in the logs.
 

2022-08-24T22:56:39.247Z [jfrt ] [ERROR] [1527aaa13675d151] [c.CentralConfigServiceImpl:961] [http-nio-8081-exec-2] - Failed to reload configuration: javax.crypto.BadPaddingException: Given final block not properly padded. Such issues can arise if a bad key is used during decryption.
2022-08-24T22:56:39.247Z [jfrt ] [ERROR] [1527aaa13675d151] [o.j.c.ExecutionUtils:190      ] [http-nio-8081-exec-2] - Last retry failed: Failed to reload configuration: javax.crypto.BadPaddingException: Given final block not properly padded. Such issues can arise if a bad key is used during decryption.. Not trying again
2022-08-24T22:56:39.249Z [jfrt ] [ERROR] [1527aaa13675d151] [ifactoryApplicationContext:728] [http-nio-8081-exec-2] - Failed system import: Could not merge and save new descriptor [org.jfrog.common.ExecutionFailed: Last retry failed: Failed to reload configuration: javax.crypto.BadPaddingException: Given final block not properly padded. Such issues can arise if a bad key is used during decryption.. Not trying again]

This will cause the import to fail.

Solution/workaround

To workaround this issue, there are two options we can look to implement.  The first is to run the decryption API mentioned above prior to running the export.  The workflow would be to run the API request (the response to the successful decryption will be “DONE”).  We would then run the System Export, migrate this export to the new server, run the System Import and can then finish after a successful import by running the encryption API.  This will generate a new artifactory.key for this migrated instance.

The second option, if decrypting is not an option, would be to manually update the artifactory.config.xml and either replace the encrypted password with plain text or remove the entire repository configuration from this config.xml file.  We would then need to add this repository back after the import if we do completely remove this repository.
To go into a bit more depth around this manual process, the passwords that we are looking for can be remote repositories that need a user/password or token to authenticate with the remote registry.  This could be another Artifactory instance or some external registry.  Below is an example configuration for a repository:

<remoteRepository>
            <key>test-remote</key>
            <type>npm</type>
            <description> (local file cache)</description>
            <notes></notes>
            <includesPattern>**/*</includesPattern>
            <excludesPattern></excludesPattern>
            <repoLayoutRef>npm-default</repoLayoutRef>
            <dockerApiVersion>V2</dockerApiVersion>
            ………………………………….
            ………………………………….            
            <blockMismatchingMimeTypes>true</blockMismatchingMimeTypes>
            <mismatchingMimeTypesOverrideList></mismatchingMimeTypesOverrideList>
            <bypassHeadRequests>false</bypassHeadRequests>
            <username>admin</username>
            <password>JE2fRswdAyuhgd2vVrevMgfoCzwHTpLu2WVP9EaZ2wJhYy87cU</password>
            <allowAnyHostAuth>false</allowAnyHostAuth>
            <socketTimeoutMillis>15000</socketTimeoutMillis>
            <enableCookieManagement>false</enableCookieManagement>
            <enableTokenAuthentication>false</enableTokenAuthentication>
            <disableProxy>false</disableProxy>
            <propagateQueryParams>false</propagateQueryParams>
            <disableUrlNormalization>false</disableUrlNormalization>
        </remoteRepository>

We can run a search on the configuration file for this “JE” as this will be the first two characters of the encrypted passwords we need to update.  After updating or removing all of these encrypted passwords, we should then be able to run the System Import to success.