JSAFE_PaddingException: Could not perform unpadding: invalid pad byte

While working on a issue it was found the Managed server was not able to Authenticate to its Admin Server in a domain. As i was able to restart the Admin Server with the boot.properties on its host, so i tried copying the same boot.properties to Managed server host followed Managed Server startup. While startup the boot.properties will be read and immediately JSAFE_PaddingException: Could not perform unpadding: invalid pad byte was fired.

After some google it was stated that all domain as different salt [SerializedSystemIni.dat] for encryption so sometime if you miss to update the encrypted password with the new salt you get this error.

Below is the log excerpt for the Error.

[com.rsa.jsafe.JSAFE_PaddingException: Could not perform unpadding: invalid pad byte.].>
<Aug 3, 2011 8:33:02 PM GMT> <Critical> <Security> <BEA-090518> <Could not decrypt the password attribute value of {3DES}71DlKVGKD9YlbDlDZg7p9g\=\= from the file ./boot.properties. If you have copied an encrypted attribute from boot.properties from another domain into ./boot.properties, change the encrypted attribute to its cleartext value then reboot the server. The attribute will be re-encrypted. Otherwise, change all encrypted attributes to their cleartext values, then reboot the server. All encryptable attributes will be re-encrypted. The decryption failed with the exception weblogic.security.internal.encryption.EncryptionServiceException - with nested exception:
[com.rsa.jsafe.JSAFE_PaddingException: Could not perform unpadding: invalid pad byte.].>

Resolution

A. Using cleartext password

Edit all the occurrences of boot.properties with cleartext password and try restarting the Server instances.

For example:

boot.properties with encrypted values

#Thu Jul 05 19:35:48 GMT 2007
password={3DES}71DlKVGKD9YlbDlDZg7p9g\=\=username={3DES}71DlKVGKD9YlbDlDZg7p9g\=\=

boot.properties with cleartext password

#Thu Jul 05 19:35:48 GMT 2007
password=weblogic
username=weblogic

B. Using encrypted password

Use the encrypt utility provided along with Weblogic to encrypt the password first and edit all the occurrences of boot.properties with the encrypted passwords.

1. In a command prompt set the classpath by running the setDomainEnv script located under your domain’s bin folder/directory.
For example: C:\oracle\Middleware\user_projects\domains\base_domain\bin
2. Execute java weblogic.security.Encrypt command which will prompt for the password and the encrypted value is printed as output.

Reference: http://download.oracle.com/docs/cd/E11035_01/wls100/admin_ref/utils.html#wp1209592

Note: The encrypt utility must be run from the Domain folder as it uses the domain’s password salt file(SerializedSystemIni.dat) for encrypting the cleartext string.

If you are not in the domain directory-structure you can pass the domain folder using the -Dweblogic.RootDirectory parameter.

Windows:

java -Dweblogic.RootDirectory=C:\oracle\Middleware\user_projects\domains\base_domain -cp C:\oracle\Middleware\wlserver_10.3\server\lib\weblogic.jar weblogic.security.Encrypt 

Unix: 

java -Dweblogic.RootDirectory="/app/oracle/Middleware/user_projects/domains/base_domain" -cp "/app/oracle/Middleware/wlserver_10.3/server/lib/weblogic.jar" weblogic.security.Encrypt

3. Edit all the occurrences of boot.properties with the encrypted passwords followed by server instance startup.

Please leave your comments/queries for this post.