Decrypt source credentials even when the converter is not injected - #2544
Merged
p-hoffmann merged 2 commits intoSep 24, 2026
Merged
Conversation
EncryptedStringConverter received its encryptor only through an @Autowired setter, relying on Hibernate resolving the converter from Spring. When that injection does not happen, as in the GraalVM native image, the encryptor stays null and EncryptorUtils.decrypt returns the value unchanged, so the JDBC driver is handed the literal ENC(...) username and password and every source query fails with "password authentication failed". The encryptor is now held statically and set directly by the defaultStringEncryptor bean, so every converter instance sees it however it was created. A converter used without an encryptor now fails instead of silently reading ENC(...) values or writing plaintext.
p-hoffmann
marked this pull request as draft
September 14, 2026 19:57
p-hoffmann
added a commit
to OHDSI/trex
that referenced
this pull request
Sep 16, 2026
…ter injection The native image runs Spring in AOT mode, which registers no AutowiredAnnotationBeanPostProcessor. Hibernate's SpringBeanContainer creates EncryptedStringConverter at runtime via createBean, so its @Autowired encryptor setter never ran and ENC(...) credentials reached the JDBC driver unchanged. OHDSI/WebAPI#2544 has the defaultStringEncryptor bean set the encryptor statically on the converter. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
p-hoffmann
added a commit
to OHDSI/trex
that referenced
this pull request
Sep 16, 2026
…ter injection The native image runs Spring in AOT mode, which registers no AutowiredAnnotationBeanPostProcessor. Hibernate's SpringBeanContainer creates EncryptedStringConverter at runtime via createBean, so its @Autowired encryptor setter never ran and ENC(...) credentials reached the JDBC driver unchanged. OHDSI/WebAPI#2544 has the defaultStringEncryptor bean set the encryptor statically on the converter.
p-hoffmann
added a commit
to OHDSI/trex
that referenced
this pull request
Sep 24, 2026
The bump to the webapi-3.0 tip regressed the boot smoke test: SMOKE_DECRYPT=failed FAIL: CleanupScheduler could not reach a source with encrypted credentials FATAL: password authentication failed for user "ENC(OatX+nJuuK4p...)" Cause: what develop pinned before this branch (f1612bee) is not on webapi-3.0 at all. It sits on p-hoffmann/encrypted-converter-static-encryptor (OHDSI/WebAPI#2544, still open) and carries "Decrypt source credentials even when the converter is not injected" -- a fix the native image depends on, because Hibernate builds the @converter itself, the @Autowired setter never runs in a closed-world image, the encryptor stays null and ENC(...) reaches the JDBC driver verbatim. Moving to the tip silently dropped it, which is exactly what the smoke test is there to catch. #2544 has now been updated from webapi-3.0 (merge f2533fe0), so its head is the webapi-3.0 tip -- BigQuery driver swap and circe 1.14.1 included -- plus that one fix. Pin there. Its diff against webapi-3.0 is only the three files of the fix. Re-pin to the webapi-3.0 tip once #2544 merges; until it does, every bump straight to the tip reintroduces this failure.
p-hoffmann
marked this pull request as ready for review
September 24, 2026 23:38
p-hoffmann
added a commit
to OHDSI/trex
that referenced
this pull request
Sep 24, 2026
OHDSI/WebAPI#2544 landed on webapi-3.0 as ba0f901f, so the tip now carries the decrypt fix the native image needs, and the submodule no longer has to point at an unmerged branch head. Pin ba0f901f. That tip is the previous pin's content by another route: webapi-3.0 through circe 1.14.1, the BigQuery JDBC driver swap (#2547), and the converter fix as a squash of #2544 rather than the merge this branch pinned. This also retires the note the previous commit left behind: a bump straight to the webapi-3.0 tip is now the correct thing to do, and no longer drops the fix that made the boot smoke test fail with SMOKE_DECRYPT=failed.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.