WLSDPLY-09015: updateDomain deployment failed: Failed to set attribute PasswordEncrypted

[engchina]

Hi Experts,

I was trying to move JCS to WebLogic Cloud on OCI and faced an error.

WLSDPLY-09015: updateDomain deployment failed: Failed to set attribute PasswordEncrypted in path /JDBCSystemResources/orcl_ds/JDBCResource/orcl_ds/JDBCDriverParams/orcl_ds to value PAsswOrd__123: wlst.set(PasswordEncrypted, PAsswOrd__123) in online mode failed : Error occurred while performing set : Error setting attribute PasswordEncrypted : In production mode, it's not allowed to set a clear text value to the property: PasswordEncrypted of JDBCDriverParamsBean

I did it as below:
Step1: Discover JCS domain -> let's name it as result.yaml
Step2: Only keep customized resources and appDeployments in result.yaml, then modify "Target" and "PasswordEncrypted".
Step3: use encryptModel.sh to encrypt modified result.yaml, it's okay.
Step4: use validateModel.sh to validate modified result.yaml, it's okay.
Step5: use updateDomain.sh with "-use_encryption" flag to update domain, but got error WLSDPLY-09015.

I tried input "plain text value" "base64 encode value" "ciphertext" into PasswordEncrypted, either of them will get error WLSDPLY-09015, what should I input into PasswordEncrypted if I want to user "-use_encryption" while using updateDomain.sh?

Thanks in advance!

[engchina]

In addition, I'm using weblogic-deploy 1.5.0.

[engchina]

What's more, 1.6.0 also has same error.

Issue Log for updateDomain version 1.6.0 running WebLogic version 12.2.1.3.0 online mode:

SEVERE Messages:

    1. WLSDPLY-09015: updateDomain deployment failed: Failed to set attribute PasswordEncrypted in path /JDBCSystemResources/orcl_ds/JDBCResource/orcl_ds/JDBCDriverParams/orcl_ds to value PAsswOrd__123: wlst.set(PasswordEncrypted, PAsswOrd__123) in online mode failed : Error occurred while performing set : Error setting attribute PasswordEncrypted : In production mode, it's not allowed to set a clear text value to the property: PasswordEncrypted of JDBCDriverParamsBean

[kaifricke]

Hello,
since WLS 9 you cannot set cleartext passwords in PROD mode , so the error is expected.
encryptModel just encrypts the passwords , so they are not in clear text when you store them somewhere, but its not the encryption required for the passwords on the domain (which is domain specific)
It would work, when you would create the domain on target with WDT (WDT would get the encrypted passwords and use them - you are retrieving resources from one domain and update another domain with those, which means you require the password encrypted by the target domain (if that is running in PROD mode)
-Kai

[rakillen]

I think there is a problem in this case where the "-use_encryption" is used in tandem with an encrypted WLST attribute. I'll investigate and respond.

[engchina]

Thanks rakillen, kaifricke for your answer.
I will wait for the final result.

[rakillen]

The fix for this has been merged into master, and will be in the next release. The initial approach was correct - put the plain-text password in the model, then use encryptModel.sh to encrypt the model, then use updateDomain.sh with "-use_encryption" flag.

[engchina]

Thanks rakillen!