@Rocky when I try to install auditloader plugin I have error: ERROR (starrocks-mysql-nio-pool-0|306) [StarrocksStreamLoader.<init>():62] AuditLoader plugin decrypt password error javax.crypto.BadPaddingException: Given final block not properly padded. Such issues can arise if a bad key is used during decryption.

This error occurs when the AuditLoader plugin attempts to decrypt the password in your

plugin.conf

but fails. This typically happens if you have a

secret_key

defined in the configuration, but the

password

provided is either plaintext or was encrypted with a different key. To resolve this, check the following in your `plugin.conf`: Option 1: Use a Plaintext Password (Recommended for simplicity) If you do not need to encrypt the password in the configuration file: 1. Open

plugin.conf

. 2. Remove or comment out the

secret_key

line. 3. Set the

password

field to your actual password in plaintext. 4. Repackage the zip and reinstall the plugin. Option 2: Use an Encrypted Password If you want to keep the password encrypted: 1. Ensure the

secret_key

is 16 bytes or less. 2. Generate the encrypted password string using the following SQL in StarRocks:

sql
   SELECT TO_BASE64(AES_ENCRYPT('your_password', 'your_secret_key'));

3. Copy the resulting Base64 string into the

password

field in

plugin.conf

. 4. Ensure the

secret_key

in

plugin.conf

exactly matches the

'your_secret_key'

used in the SQL command above. Important Note on Reinstallation When you modify

plugin.conf

, you must: 1. Uninstall the existing plugin:

UNINSTALL PLUGIN AuditLoader;

2. Zip the updated files back into

auditloader.zip

. 3. Distribute the new zip to the same path on all FE nodes. 4. Reinstall:

INSTALL PLUGIN FROM "/path/to/auditloader.zip";

For more details, see the Manage audit logs within StarRocks via AuditLoader documentation. References • administration/management/audit_loader.md • knowledge/usage/best-practice.md

@Rocky I see that in plugins/AuditLoader there is plugin.conf which hase the correct values in it (we use encryption)

The

BadPaddingException

error confirms that the plugin is attempting to decrypt the

password

field using a

secret_key

, but the decryption is failing. This usually happens because of a mismatch between the encryption key and the password string, or because the plugin is misinterpreting a plaintext password as an encrypted one. Even if the values look correct, please verify these specific details: 1. Check if

secret_key

is actually "Unset" If you are trying to use a plaintext password: * Don't just leave

secret_key

blank (e.g.,

secret_key=

). If the key exists in the file, even if empty, the plugin may still try to trigger the decryption logic. * Action: Completely remove the

secret_key

line from

plugin.conf

or comment it out by adding a

#

at the start:

properties
    # secret_key=
    password=your_actual_plaintext_password

2. Verify Encryption Method (if using

secret_key

) If you are intentionally using an encrypted password: * The

secret_key

must be 16 characters or fewer. * The

password

value must be generated using this exact SQL command in StarRocks:

sql
    SELECT TO_BASE64(AES_ENCRYPT('your_actual_password', 'your_secret_key'));

* Ensure there are no trailing spaces or newlines in the

password

string in

plugin.conf

. 3. Ensure you are editing the "Active" Configuration StarRocks doesn't always live-reload

plugin.conf

from the folder you're looking at. To ensure your changes take effect: 1. Uninstall the current plugin:

UNINSTALL PLUGIN AuditLoader;

2. Repackage the zip file with your updated

plugin.conf

. 3. Reinstall using the full path to that zip file. 4. Check the

fe.log

again. Quick Test: To rule out encryption issues, try setting the password to plaintext and deleting the

secret_key

line entirely from the config. If it installs successfully this way, the issue was definitely a mismatch in the AES encryption/decryption parameters. References • administration/management/audit_loader.md • sql-reference/sql-statements/cluster-management/plugin/INSTALL_PLUGIN.md References • administration/management/audit_loader.md • administration/management/FE_configuration.md • knowledge/usage/best-practice.md

@Rocky no we use encryption and secret_key is set correctly

Even if the values in

plugin.conf

appear correct to the naked eye, the

BadPaddingException

specifically indicates that the Java decryption process is receiving a byte sequence that doesn't align with the expected AES padding. This is almost always caused by "invisible" characters or a mismatch in the environment. Please check these four specific areas: 1. Check for Trailing Spaces or Hidden Characters This is the most common cause. A single space at the end of the line in

plugin.conf

will be included in the key or password string, causing decryption to fail. * Action: On your FE server, run the following command to see hidden characters:

bash
    cat -e /path/to/your/plugin.conf

* What to look for: * If you see a space before the

$

(which represents the end of the line), delete it. * If you see

^M$

, it means the file has Windows-style line endings (CRLF). You must convert it to Linux format (LF) using

dos2unix

. 2. Verify

block_encryption_mode

StarRocks'

AES_ENCRYPT

function is affected by a session variable. If this was changed in your environment, the resulting Base64 string will be incompatible with the plugin's Java code. * Action: Run this in your MySQL client to ensure you are using the default (which the plugin expects):

sql
    SET block_encryption_mode = 'aes-128-ecb';
    SELECT TO_BASE64(AES_ENCRYPT('your_password', 'your_secret_key'));

* Compare this result with the

password

currently in your

plugin.conf

. 3. Check for Quotes In

plugin.conf

, values should not be wrapped in quotes. * Wrong:

secret_key="mykey123"

* Correct:

secret_key=mykey123

4. Multi-FE Consistency If you have multiple Frontends (FEs), StarRocks attempts to install the plugin on all of them. * The Problem: If you edited the

plugin.conf

on one FE node but the

auditloader.zip

file on another FE node still contains the old/incorrect config, the

INSTALL PLUGIN

command will fail because the follower FEs cannot decrypt their local version of the file. * Action: 1.

UNINSTALL PLUGIN AuditLoader;

2. Ensure the exact same

auditloader.zip

(containing the updated

plugin.conf

) is placed in the exact same absolute path on every FE node. 3. Run

INSTALL PLUGIN

again. Pro Tip: To verify if the issue is the encryption itself, temporarily remove the

secret_key

line and use the plaintext password. If that works, you've confirmed the issue is strictly with the AES key/string format or the Base64 string characters. References • administration/management/audit_loader.md • sql-reference/sql-functions/string-functions/AES_ENCRYPT.md • administration/management/FE_configuration.md • sql-reference/sql-statements/cluster-management/plugin/INSTALL_PLUGIN.md References • administration/management/audit_loader.md • administration/management/FE_configuration.md