In a FIPS enabled Clustered Environment, the RMI Authentication Key can Prevent Nodes from Starting

XMLWordPrintable

    • 10.03
    • 1
    • Severity 3 - Minor

      Issue Summary

      When Jira is setup as a clustered environment and FIPS is enabled, then cluster authentication encryption key might not be able to be read by Jira. As a result, the node will not be able to start until the rmi.socket.cluster.auth.secret.key is set to a blank value. 

      Steps to Reproduce

      1. Setup a FIPS enabled Deployment
      2. Cluster the Environment
      3. Try to start Node 2

      Expected Results

      Node 2 starts successfully

      Actual Results

      Jira fails to start on the new node and the below exception is thrown in the atlassian-jira.log file:

      ERROR      [c.a.jira.startup.ComponentContainerLauncher] A fatal error occurred during initialisation. JIRA has been locked.
      net.sf.ehcache.CacheException: java.util.concurrent.CompletionException: java.lang.IllegalArgumentException: Illegal base64 character 7b
      	at net.sf.ehcache.CacheManager.init(CacheManager.java:426)
          ...
      Caused by: java.lang.IllegalArgumentException: Illegal base64 character 7b
      	at java.base/java.util.Base64$Decoder.decode0(Base64.java:848)
      	at java.base/java.util.Base64$Decoder.decode(Base64.java:566)  

      Workaround

      To mitigate the error and allow subsequent nodes to start, run the following SQL query against Jira's database.

      update securityproperty set property_value = '' where property_key = 'rmi.socket.cluster.auth.secret.key'; 

      This is similar to: Fix Second Node Startup Issue due to Encryption Key Issue but because FIPS is enabled, if you delete the encryption key then Jira is still unable to use it after it has been re-negotiated.

              Assignee:
              Unassigned
              Reporter:
              Patrick Turbett
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

                Created:
                Updated: