Issue Summary

When Secret Service is explicitly disabled with -Datlassian.secret.service.state=disabled, Jira's RMI cluster-authentication path does not handle an already migrated rmi.socket.cluster.auth.secret.key consistently.

Other startup paths, such as database configuration, use a legacy storage path when Secret Service is disabled. However, the RMI cluster-authentication path falls back to the securityproperty database value. For migrated secrets this is ATL_SECURED, a Secret Service marker rather than the Base64-encoded key. Jira then attempts to decode the marker and fails during node startup.

Steps to Reproduce

1. Set up a clustered Jira Data Center environment
2. Ensure rmi.socket.cluster.auth.secret.key has migrated to Secret Service, so that the corresponding securityproperty value is ATL_SECURED
3. Start Jira with the JVM argument -Datlassian.secret.service.state=disabled
4. Start a subsequent cluster node

Expected Results

When Secret Service is explicitly disabled, Jira handles an already migrated RMI cluster-authentication key consistently with other Secret Service consumers.

Jira should not attempt to Base64-decode the ATL_SECURED migration marker. It should either use a supported legacy key-storage or regeneration path, or fail with a clear actionable error explaining that Secret Service must be enabled before RMI cluster authentication can be used.

Actual Results

The RMI cluster-authentication path falls back to the securityproperty database value ATL_SECURED and attempts to decode it as Base64. Node startup fails with Illegal base64 character 7b, without identifying the disabled Secret Service configuration or the migrated-secret state.

The new node fails to start and the following exception is logged in atlassian-jira.log:

ERROR      [c.a.jira.startup.ComponentContainerLauncher] A fatal error occurred during initialisation. JIRA has been locked.
net.sf.ehcache.CacheException: java.util.concurrent.CompletionException: java.lang.IllegalArgumentException: Illegal base64 character 7b
	at net.sf.ehcache.CacheManager.init(CacheManager.java:426)
    ...
Caused by: java.lang.IllegalArgumentException: Illegal base64 character 7b
	at java.base/java.util.Base64$Decoder.decode0(Base64.java:848)
	at java.base/java.util.Base64$Decoder.decode(Base64.java:566)  

Workaround

Remove -Datlassian.secret.service.state=disabled and restore Secret Service before restarting Jira or attempting to regenerate the cluster-authentication key.

As a temporary mitigation, the following SQL query sets the RMI cluster-authentication property to blank, allowing the node to start without using RMI cluster authentication:

update securityproperty
set property_value = ''
where property_key = 'rmi.socket.cluster.auth.secret.key';

Note: This is not successful key renegotiation. It is a mitigation that bypasses RMI cluster authentication.