CODEWITHSUNDEEP
artifactoryjfrog-container-registry
Onkar Naik
Onkar Naik

Reputation: 1

Jfrog Import from one artifactory server to another artifactory instance

Failed system import: Could not merge and save new descriptor [org.jfrog.common.ExecutionFailed: Last retry failed: Failed to reload configuration: javax.crypto.BadPaddingException: Given final block not properly padded. Such issues can arise if a bad key is used during decryption.. Not trying again]

Export with excluding content & metadata.

Imported without checking any of the options but not successful due to bad key exception.

Also tried out various troubleshooting options like disabling encryption on source instance as well as removing join.key and admin token.

Upvotes: 0

Views: 955

Answers (1)

David Livshin
David Livshin

Reputation: 166

That error occurs when the instance you exported from and import to have different master.key files.

The master.key is used to encrypt any passwords and other sensitive data you may have saved in your configuration files, so with a different master.key, the new instance can not unencrypted any of this data.

To rectify this there are three approaches.

  1. Ensure the target Artifactory has the same master.key as the source Artifactory. You must place the source master.key in place before starting the target Artifactory for the first time, otherwise key data is encrypted by Artifactory with the wrong master.key (You can try to reset the master.key in your target Artifactory using this article https://jfrog.com/help/r/how-to-recover-the-master-key/how-to-reset-the-master-key)

  2. Use the decrypt key API (https://jfrog.com/help/r/jfrog-rest-apis/activate-artifactory-key-encryption) before running export from your source instance. This should decrypt all the sensitive passwords in the subsequent generated export, allowing for a successful import to an instance with a different master.key The command should look something like this:

     curl -u admin http://localhost:8081/artifactory/api/system/decrypt -XPOST

  3. You could go through the export and find all the encrypted passwords and remove/replace them with the unencrypted versions. You should look for strings beginning: JE. Although I can't guarantee this option.

Upvotes: 1

Related Questions