Spring-cloud-config: CipherEnvironmentEncryptor doesn't work with complex types on Spring Boot 1.4

[philwebb]

Given a config like this:

mine[0].someValue=Foo
mine[0].someKey={cipher}XXXX
mine[1].someValue=Bar
mine[1].someKey={cipher}XXXX

Only the ciphered values get bound to the @ConfigurationProperties. I think that the root cause is the way that CipherEnvironmentEncryptor creates new property sources combined with Spring Boot issue 4313 which is much stricter in the way that it merges properties from different sources.

If I'm reading the code correctly ciphered values are extracted to a new property source that's added above the original source. If CipherEnvironmentEncryptor could create a new source that includes all the old values I believe the problem would go away.

[philwebb]

/cc @marcellodesales

[philwebb]

/cc @dsyer @spencergibb

[marcellodesales]

Thanks @philwebb for debugging this... @dsyer @spencergibb let me know if you guys are available some time here in the SpringOne'16 and so I can show the running app...

I have a working application I've been using since the release of RC1... I tried to migrate from 1.4.0-RC1 to 1.4.0-RELEASE this morning and all my non-encrypted values are not bound.

Gradle Change

diff --git a/build.gradle b/build.gradle
index daa9f4c..961a96d 100644
--- a/build.gradle
+++ b/build.gradle
@@ -15,7 +15,7 @@ description = "Config Service Publisher $version"

 buildscript {
   ext {
-    springBootVersion = '1.4.0.RC1'
+    springBootVersion = '1.4.0.RELEASE'
   }

Application Env

Here's the output of the actuator endpoint from the migrated app...

• All the properties from the decrypted object below got properly bound to the array element from a @ConfigrationProperties class
• All the properties that does not have the cipher values did NOT get bound.

$ curl localhost:8080/env | jq
{
  "profiles": [
    "publisher"
  ],
  "server.ports": {
    "local.server.port": 8080
  },
  "decrypted": {
    "onboard.apps[0].githubAccessToken": "******",
    "onboard.apps[0].awsAccessKey": "******",
    "onboard.apps[0].awsSecretKey": "******",
    "onboard.apps[1].githubAccessToken": "******",
    "onboard.apps[1].awsAccessKey": "******",
    "onboard.apps[1].awsSecretKey": "******"
  },
  "configService:https://github.company.com/servicesplatform-tools/spring-cloud-config-server-config/application-publisher.properties": {
    "github.host": "github.company.com",
    "build.branch": "${branch}",
    "endpoints.enabled": "true",
    "build.commit": "${commit}",
    "github.cloneBaseDir": "/tmp",
    "build.version": "${version}",
    "build.timestamp": "${timestamp.format('YYYYMMddHHmmss')}",
    "github.token": "******"
  },
  "configService:https://github.company.com/servicesplatform-tools/spring-cloud-config-server-config/application-publisher.yml": {
    "onboard.apps[0].githubOrgRepo": "servicesplatform-tools/spring-cloud-config-publisher-config",
    "onboard.apps[0].githubAccessToken": "******",
    "onboard.apps[0].githubWebhookSecret": "******",
    "onboard.apps[0].awsAccessKey": "******",
    "onboard.apps[0].awsSecretKey": "******",
    "onboard.apps[0].awsS3Bucket": "caas-XYZXYZ-XYZ",
    "onboard.apps[1].githubOrgRepo": "servicesplatform-tools/ctg-config",
    "onboard.apps[1].githubAccessToken": "******",
    "onboard.apps[1].githubWebhookSecret": "******",
    "onboard.apps[1].awsAccessKey": "******",
    "onboard.apps[1].awsSecretKey": "******",
    "onboard.apps[1].awsS3Bucket": "caas-XYZXYZ-XYZ"
  },

Property file

@Component
@ConfigurationProperties(prefix = "onboard")
public class OnboardProperties {

  /**
   * The current spring server URL.
   */
  @Value("${spring.cloud.config.uri:http://localhost:8888}")
  private String configServerUrl;
  /**
   * The applications setup for the
   */
  private Onboard[] apps;

  public String getConfigServerUrl() {
    return configServerUrl;
  }

  public void setConfigServerUrl(String configServerUrl) {
    this.configServerUrl = configServerUrl;
  }

  public void setApps(Onboard[] apps) {
    this.apps = apps;
  }

  public Onboard[] getApps() {
    return this.apps;
  }

}

[philwebb]

I've been digging a bit more into this and I'm confident that the root cause is the fact that complex types are split across property sources and that's not supported in Spring Boot 1.4.

Specifically your curl localhost:8080/env | jq output is very revealing in that onboard.apps[0] keys appear in both the decrypted and configService source.

Unfortunately I can't figure out what it adding the decrypted source.

[dsyer]

Why does it matter what is adding the extra property source? Surely we ought to be able to support multiple property sources more flexibly? I think this is a bug in Boot if we don't.

[philwebb]

See https://github.com/spring-projects/spring-boot/issues/4313 for background on why we wanted to tighten the rules.

[dsyer]

That doesn't explain anything. It just shows how bizarre the expected outcome is. Surely we can't be saying this is correct?

[ryanjbaxter]

I am not able to reproduce the problem.

here is my properties file (in a git repo)

mine.mines[0].someValue=Foo
mine.mines[0].someKey={cipher}AQBjMvbaxkS4l9N3lDfqfy62n0HPrcF7LMQm0hmiOb8dURZH8zZkI6BgLNfosPnInz3h8IFkzcUhoVqunqZVjzQQbbgLWGIR9BvkbJXe/wjbxKyjOHbtEP1Izk0WwBZRM/m3YZSkhr1Lce7UbYAnFwWd1HztUYyga16KvTZ9I2saKcSOhf56sVYjEcfXzFcDxkqR6gaJSz8qmn6ZewRV3jo2KPL+c3HysI/H8yfNLZCdOFI38yWajjP4VQdPTiW/jh4HQcKRKruLlWjIHUkpSTi6wM3oIp+NFe29lt//yuqT8SgjFaYYRx/kSIJzvkUYXmX/5tEu7lqT+LY45cwmZh/69mvP/DlToF5ghRVlZ5KsxWH6R2IyPHAHkU+YxJ8KUhQ=
mine.mines[1].someValue=Bar
mine.mines[1].someKey={cipher}AQBLo/Mwlw4GduX+EiwY7LxUL1MmDV0s452TiJGzNzmTS6gXQa1OeqOwvN7gruIxKwheFotgMe1+i5QyoW5YNHD56OFkgqEDOrIy7c5zwURjkmk/8B1da+5Vb36IOyeJejnQWfg87D1faUOQIFgXNO/gFCzigCyBUS9nFbigtZGLBlUXCdGfkUu3YK9dTmdopnPUEMjWiDxGL3cIGs4eBU1bCRSiGsz9SP2jaMfH57GkbZginx95JFyZBfWvxeRsGshKT7SgFbSH8xU5sLWj1aqwgOJXd3mCpHA3PMGZ8yEfxK8s6sidJDanV1i41xD5y5EEE9Bt7MB2jLh0u/CDC2NYbE9/jFLiMtcSnjlX5seWmFmxMJFQziDP8JRDBPD3BT4=

Here is the output from the /env endpoint on the config client

{
    "profiles": [],
    "server.ports": {
        "local.server.port": 8080
    },
    "configService:https://github.com/ryanjbaxter/config-repo/cypher.properties": {
        "mine[1].someValue": "Bar",
        "mine[0].someValue": "Foo",
        "mine[0].someKey": "******",
        "mine[1].someKey": "******"
    },
    "configService:https://github.com/ryanjbaxter/config-repo/application.yml": {
        "info.description": "Spring Cloud Samples",
        "info.url": "https://github.com/spring-cloud-samples",
        "eureka.client.serviceUrl.defaultZone": "http://localhost:8761/eureka/"
    },
    "servletContextInitParams": {},
    "systemProperties": {
        "java.runtime.name": "Java(TM) SE Runtime Environment",
        "spring.output.ansi.enabled": "always",
        "sun.boot.library.path": "/Library/Java/JavaVirtualMachines/jdk1.8.0_91.jdk/Contents/Home/jre/lib",
        "java.vm.version": "25.91-b14",
        "gopherProxySet": "false",
        "java.vm.vendor": "Oracle Corporation",
        "java.vendor.url": "http://java.oracle.com/",
        "path.separator": ":",
        "java.vm.name": "Java HotSpot(TM) 64-Bit Server VM",
        "file.encoding.pkg": "sun.io",
        "user.country": "US",
        "sun.java.launcher": "SUN_STANDARD",
        "sun.os.patch.level": "unknown",
        "PID": "39791",
        "java.vm.specification.name": "Java Virtual Machine Specification",
        "user.dir": "/Users/ryanjbaxter/git-repos/ryanjbaxter/spring-cloud-samples/springcloudconfigclient",
        "java.runtime.version": "1.8.0_91-b14",
        "java.awt.graphicsenv": "sun.awt.CGraphicsEnvironment",
        "org.jboss.logging.provider": "slf4j",
        "java.endorsed.dirs": "/Library/Java/JavaVirtualMachines/jdk1.8.0_91.jdk/Contents/Home/jre/lib/endorsed",
        "os.arch": "x86_64",
        "java.io.tmpdir": "/var/folders/k3/zv8hzdm17vv69j485fv3cf9r0000gn/T/",
        "line.separator": "\n",
        "java.vm.specification.vendor": "Oracle Corporation",
        "os.name": "Mac OS X",
        "sun.jnu.encoding": "UTF-8",
        "spring.beaninfo.ignore": "true",
        "java.library.path": "/Users/ryanjbaxter/Library/Java/Extensions:/Library/Java/Extensions:/Network/Library/Java/Extensions:/System/Library/Java/Extensions:/usr/lib/java:.",
        "java.specification.name": "Java Platform API Specification",
        "java.class.version": "52.0",
        "sun.management.compiler": "HotSpot 64-Bit Tiered Compilers",
        "os.version": "10.11.6",
        "http.nonProxyHosts": "local|*.local|169.254/16|*.169.254/16",
        "user.home": "/Users/ryanjbaxter",
        "catalina.useNaming": "false",
        "user.timezone": "America/New_York",
        "java.awt.printerjob": "sun.lwawt.macosx.CPrinterJob",
        "file.encoding": "UTF-8",
        "java.specification.version": "1.8",
        "catalina.home": "/private/var/folders/k3/zv8hzdm17vv69j485fv3cf9r0000gn/T/tomcat.1501181160120230569.8080",
        "java.class.path": "/Library/Java/JavaVirtualMachines/jdk1.8.0_91.jdk/Contents/Home/jre/lib/charsets.jar:/Library/Java/JavaVirtualMachines/jdk1.8.0_91.jdk/Contents/Home/jre/lib/deploy.jar:/Library/Java/JavaVirtualMachines/jdk1.8.0_91.jdk/Contents/Home/jre/lib/ext/cldrdata.jar:/Library/Java/JavaVirtualMachines/jdk1.8.0_91.jdk/Contents/Home/jre/lib/ext/dnsns.jar:/Library/Java/JavaVirtualMachines/jdk1.8.0_91.jdk/Contents/Home/jre/lib/ext/jaccess.jar:/Library/Java/JavaVirtualMachines/jdk1.8.0_91.jdk/Contents/Home/jre/lib/ext/jfxrt.jar:/Library/Java/JavaVirtualMachines/jdk1.8.0_91.jdk/Contents/Home/jre/lib/ext/localedata.jar:/Library/Java/JavaVirtualMachines/jdk1.8.0_91.jdk/Contents/Home/jre/lib/ext/nashorn.jar:/Library/Java/JavaVirtualMachines/jdk1.8.0_91.jdk/Contents/Home/jre/lib/ext/sunec.jar:/Library/Java/JavaVirtualMachines/jdk1.8.0_91.jdk/Contents/Home/jre/lib/ext/sunjce_provider.jar:/Library/Java/JavaVirtualMachines/jdk1.8.0_91.jdk/Contents/Home/jre/lib/ext/sunpkcs11.jar:/Library/Java/JavaVirtualMachines/jdk1.8.0_91.jdk/Contents/Home/jre/lib/ext/zipfs.jar:/Library/Java/JavaVirtualMachines/jdk1.8.0_91.jdk/Contents/Home/jre/lib/javaws.jar:/Library/Java/JavaVirtualMachines/jdk1.8.0_91.jdk/Contents/Home/jre/lib/jce.jar:/Library/Java/JavaVirtualMachines/jdk1.8.0_91.jdk/Contents/Home/jre/lib/jfr.jar:/Library/Java/JavaVirtualMachines/jdk1.8.0_91.jdk/Contents/Home/jre/lib/jfxswt.jar:/Library/Java/JavaVirtualMachines/jdk1.8.0_91.jdk/Contents/Home/jre/lib/jsse.jar:/Library/Java/JavaVirtualMachines/jdk1.8.0_91.jdk/Contents/Home/jre/lib/management-agent.jar:/Library/Java/JavaVirtualMachines/jdk1.8.0_91.jdk/Contents/Home/jre/lib/plugin.jar:/Library/Java/JavaVirtualMachines/jdk1.8.0_91.jdk/Contents/Home/jre/lib/resources.jar:/Library/Java/JavaVirtualMachines/jdk1.8.0_91.jdk/Contents/Home/jre/lib/rt.jar:/Library/Java/JavaVirtualMachines/jdk1.8.0_91.jdk/Contents/Home/lib/ant-javafx.jar:/Library/Java/JavaVirtualMachines/jdk1.8.0_91.jdk/Contents/Home/lib/dt.jar:/Library/Java/JavaVirtualMachines/jdk1.8.0_91.jdk/Contents/Home/lib/javafx-mx.jar:/Library/Java/JavaVirtualMachines/jdk1.8.0_91.jdk/Contents/Home/lib/jconsole.jar:/Library/Java/JavaVirtualMachines/jdk1.8.0_91.jdk/Contents/Home/lib/packager.jar:/Library/Java/JavaVirtualMachines/jdk1.8.0_91.jdk/Contents/Home/lib/sa-jdi.jar:/Library/Java/JavaVirtualMachines/jdk1.8.0_91.jdk/Contents/Home/lib/tools.jar:/Users/ryanjbaxter/git-repos/ryanjbaxter/spring-cloud-samples/springcloudconfigclient/target/classes:/Users/ryanjbaxter/.m2/repository/org/springframework/boot/spring-boot-starter-actuator/1.4.0.RELEASE/spring-boot-starter-actuator-1.4.0.RELEASE.jar:/Users/ryanjbaxter/.m2/repository/org/springframework/boot/spring-boot-starter/1.4.0.RELEASE/spring-boot-starter-1.4.0.RELEASE.jar:/Users/ryanjbaxter/.m2/repository/org/springframework/boot/spring-boot/1.4.0.RELEASE/spring-boot-1.4.0.RELEASE.jar:/Users/ryanjbaxter/.m2/repository/org/springframework/boot/spring-boot-autoconfigure/1.4.0.RELEASE/spring-boot-autoconfigure-1.4.0.RELEASE.jar:/Users/ryanjbaxter/.m2/repository/org/springframework/boot/spring-boot-starter-logging/1.4.0.RELEASE/spring-boot-starter-logging-1.4.0.RELEASE.jar:/Users/ryanjbaxter/.m2/repository/ch/qos/logback/logback-classic/1.1.7/logback-classic-1.1.7.jar:/Users/ryanjbaxter/.m2/repository/ch/qos/logback/logback-core/1.1.7/logback-core-1.1.7.jar:/Users/ryanjbaxter/.m2/repository/org/slf4j/jcl-over-slf4j/1.7.21/jcl-over-slf4j-1.7.21.jar:/Users/ryanjbaxter/.m2/repository/org/slf4j/jul-to-slf4j/1.7.21/jul-to-slf4j-1.7.21.jar:/Users/ryanjbaxter/.m2/repository/org/slf4j/log4j-over-slf4j/1.7.21/log4j-over-slf4j-1.7.21.jar:/Users/ryanjbaxter/.m2/repository/org/yaml/snakeyaml/1.17/snakeyaml-1.17.jar:/Users/ryanjbaxter/.m2/repository/org/springframework/boot/spring-boot-actuator/1.4.0.RELEASE/spring-boot-actuator-1.4.0.RELEASE.jar:/Users/ryanjbaxter/.m2/repository/org/springframework/spring-context/4.3.2.RELEASE/spring-context-4.3.2.RELEASE.jar:/Users/ryanjbaxter/.m2/repository/org/springframework/cloud/spring-cloud-starter-config/1.1.2.RELEASE/spring-cloud-starter-config-1.1.2.RELEASE.jar:/Users/ryanjbaxter/.m2/repository/org/springframework/cloud/spring-cloud-starter/1.1.1.RELEASE/spring-cloud-starter-1.1.1.RELEASE.jar:/Users/ryanjbaxter/.m2/repository/org/springframework/cloud/spring-cloud-context/1.1.1.RELEASE/spring-cloud-context-1.1.1.RELEASE.jar:/Users/ryanjbaxter/.m2/repository/org/springframework/security/spring-security-crypto/4.1.1.RELEASE/spring-security-crypto-4.1.1.RELEASE.jar:/Users/ryanjbaxter/.m2/repository/org/springframework/cloud/spring-cloud-commons/1.1.1.RELEASE/spring-cloud-commons-1.1.1.RELEASE.jar:/Users/ryanjbaxter/.m2/repository/org/springframework/security/spring-security-rsa/1.0.1.RELEASE/spring-security-rsa-1.0.1.RELEASE.jar:/Users/ryanjbaxter/.m2/repository/org/bouncycastle/bcpkix-jdk15on/1.47/bcpkix-jdk15on-1.47.jar:/Users/ryanjbaxter/.m2/repository/org/bouncycastle/bcprov-jdk15on/1.47/bcprov-jdk15on-1.47.jar:/Users/ryanjbaxter/.m2/repository/org/springframework/cloud/spring-cloud-config-client/1.1.2.RELEASE/spring-cloud-config-client-1.1.2.RELEASE.jar:/Users/ryanjbaxter/.m2/repository/com/fasterxml/jackson/core/jackson-annotations/2.8.1/jackson-annotations-2.8.1.jar:/Users/ryanjbaxter/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.8.1/jackson-databind-2.8.1.jar:/Users/ryanjbaxter/.m2/repository/com/fasterxml/jackson/core/jackson-core/2.8.1/jackson-core-2.8.1.jar:/Users/ryanjbaxter/.m2/repository/org/springframework/boot/spring-boot-starter-web/1.4.0.RELEASE/spring-boot-starter-web-1.4.0.RELEASE.jar:/Users/ryanjbaxter/.m2/repository/org/springframework/boot/spring-boot-starter-tomcat/1.4.0.RELEASE/spring-boot-starter-tomcat-1.4.0.RELEASE.jar:/Users/ryanjbaxter/.m2/repository/org/apache/tomcat/embed/tomcat-embed-core/8.5.4/tomcat-embed-core-8.5.4.jar:/Users/ryanjbaxter/.m2/repository/org/apache/tomcat/embed/tomcat-embed-el/8.5.4/tomcat-embed-el-8.5.4.jar:/Users/ryanjbaxter/.m2/repository/org/apache/tomcat/embed/tomcat-embed-websocket/8.5.4/tomcat-embed-websocket-8.5.4.jar:/Users/ryanjbaxter/.m2/repository/org/hibernate/hibernate-validator/5.2.4.Final/hibernate-validator-5.2.4.Final.jar:/Users/ryanjbaxter/.m2/repository/javax/validation/validation-api/1.1.0.Final/validation-api-1.1.0.Final.jar:/Users/ryanjbaxter/.m2/repository/org/jboss/logging/jboss-logging/3.3.0.Final/jboss-logging-3.3.0.Final.jar:/Users/ryanjbaxter/.m2/repository/com/fasterxml/classmate/1.3.1/classmate-1.3.1.jar:/Users/ryanjbaxter/.m2/repository/org/springframework/spring-web/4.3.2.RELEASE/spring-web-4.3.2.RELEASE.jar:/Users/ryanjbaxter/.m2/repository/org/springframework/spring-aop/4.3.2.RELEASE/spring-aop-4.3.2.RELEASE.jar:/Users/ryanjbaxter/.m2/repository/org/springframework/spring-beans/4.3.2.RELEASE/spring-beans-4.3.2.RELEASE.jar:/Users/ryanjbaxter/.m2/repository/org/springframework/spring-webmvc/4.3.2.RELEASE/spring-webmvc-4.3.2.RELEASE.jar:/Users/ryanjbaxter/.m2/repository/org/springframework/spring-expression/4.3.2.RELEASE/spring-expression-4.3.2.RELEASE.jar:/Users/ryanjbaxter/.m2/repository/org/slf4j/slf4j-api/1.7.21/slf4j-api-1.7.21.jar:/Users/ryanjbaxter/.m2/repository/org/springframework/spring-core/4.3.2.RELEASE/spring-core-4.3.2.RELEASE.jar:/Applications/IntelliJ IDEA.app/Contents/lib/idea_rt.jar",
        "user.name": "ryanjbaxter",
        "java.vm.specification.version": "1.8",
        "sun.java.command": "com.example.SpringCloudConfigClientApplication",
        "java.home": "/Library/Java/JavaVirtualMachines/jdk1.8.0_91.jdk/Contents/Home/jre",
        "sun.arch.data.model": "64",
        "user.language": "en",
        "java.specification.vendor": "Oracle Corporation",
        "awt.toolkit": "sun.lwawt.macosx.LWCToolkit",
        "java.vm.info": "mixed mode",
        "java.version": "1.8.0_91",
        "java.ext.dirs": "/Users/ryanjbaxter/Library/Java/Extensions:/Library/Java/JavaVirtualMachines/jdk1.8.0_91.jdk/Contents/Home/jre/lib/ext:/Library/Java/Extensions:/Network/Library/Java/Extensions:/System/Library/Java/Extensions:/usr/lib/java",
        "sun.boot.class.path": "/Library/Java/JavaVirtualMachines/jdk1.8.0_91.jdk/Contents/Home/jre/lib/resources.jar:/Library/Java/JavaVirtualMachines/jdk1.8.0_91.jdk/Contents/Home/jre/lib/rt.jar:/Library/Java/JavaVirtualMachines/jdk1.8.0_91.jdk/Contents/Home/jre/lib/sunrsasign.jar:/Library/Java/JavaVirtualMachines/jdk1.8.0_91.jdk/Contents/Home/jre/lib/jsse.jar:/Library/Java/JavaVirtualMachines/jdk1.8.0_91.jdk/Contents/Home/jre/lib/jce.jar:/Library/Java/JavaVirtualMachines/jdk1.8.0_91.jdk/Contents/Home/jre/lib/charsets.jar:/Library/Java/JavaVirtualMachines/jdk1.8.0_91.jdk/Contents/Home/jre/lib/jfr.jar:/Library/Java/JavaVirtualMachines/jdk1.8.0_91.jdk/Contents/Home/jre/classes",
        "java.awt.headless": "true",
        "java.vendor": "Oracle Corporation",
        "catalina.base": "/private/var/folders/k3/zv8hzdm17vv69j485fv3cf9r0000gn/T/tomcat.1501181160120230569.8080",
        "file.separator": "/",
        "java.vendor.url.bug": "http://bugreport.sun.com/bugreport/",
        "sun.io.unicode.encoding": "UnicodeBig",
        "sun.cpu.endian": "little",
        "socksNonProxyHosts": "local|*.local|169.254/16|*.169.254/16",
        "ftp.nonProxyHosts": "local|*.local|169.254/16|*.169.254/16",
        "sun.cpu.isalist": ""
    },
    "systemEnvironment": {
        "PATH": "/usr/bin:/bin:/usr/sbin:/sbin:/Users/ryanjbaxter/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin:/usr/local/MacGPG2/bin:/Users/ryanjbaxter/bin",
        "TERM": "xterm-256color",
        "LANG": "en_US.UTF-8",
        "VIRTUAL_ENV_DISABLE_PROMPT": "1",
        "ITERM_SESSION_ID": "w0t4p1:BF45FCCB-CE95-4B49-BAE3-C0C8CA332E11",
        "VERSIONER_PYTHON_VERSION": "2.7",
        "LOGNAME": "ryanjbaxter",
        "PWD": "/Users/ryanjbaxter/git-repos/ryanjbaxter/spring-cloud/gap-config-client",
        "XPC_SERVICE_NAME": "com.jetbrains.intellij.140192",
        "TERM_PROGRAM_VERSION": "3.0.5",
        "_": "/usr/bin/open",
        "SHELL": "/bin/zsh",
        "TERM_PROGRAM": "iTerm.app",
        "PAGER": "less",
        "LSCOLORS": "Gxfxcxdxbxegedabagacad",
        "OLDPWD": "/Applications/IntelliJ IDEA.app/Contents/bin",
        "USER": "ryanjbaxter",
        "VERSIONER_PYTHON_PREFER_32_BIT": "no",
        "ZSH": "/Users/ryanjbaxter/.oh-my-zsh",
        "TMPDIR": "/var/folders/k3/zv8hzdm17vv69j485fv3cf9r0000gn/T/",
        "ITERM_PROFILE": "Default",
        "SSH_AUTH_SOCK": "/private/tmp/com.apple.launchd.KEeummBBFP/Listeners",
        "XPC_FLAGS": "0x0",
        "TERM_SESSION_ID": "w0t4p1:BF45FCCB-CE95-4B49-BAE3-C0C8CA332E11",
        "__CF_USER_TEXT_ENCODING": "0x1F5:0x0:0x0",
        "JAVA_MAIN_CLASS_39791": "com.example.SpringCloudConfigClientApplication",
        "Apple_PubSub_Socket_Render": "/private/tmp/com.apple.launchd.NNBTee8Xcg/Render",
        "LESS": "-R",
        "COLORFGBG": "7;0",
        "LC_CTYPE": "en_US.UTF-8",
        "SHLVL": "2",
        "HOME": "/Users/ryanjbaxter"
    },
    "springCloudClientHostInfo": {
        "spring.cloud.client.hostname": "192.168.1.147",
        "spring.cloud.client.ipAddress": "192.168.1.147"
    },
    "applicationConfig: [classpath:/bootstrap.properties]": {
        "spring.application.name": "cypher"
    },
    "defaultProperties": {}
}

Here is my class annotated with @ConfigurationProperties

@Configuration
@ConfigurationProperties(prefix = "mine")
public class MineProperties {

    @Value("${spring.cloud.config.uri:http://localhost:8888}")
    private String configServerUrl;

    private Mine[] mines;

    public String getConfigServerUrl() {
        return configServerUrl;
    }

    public void setConfigServerUrl(String configServerUrl) {
        this.configServerUrl = configServerUrl;
    }

    public Mine[] getMines() {
        return mines;
    }

    public void setMines(Mine[] mines) {
        this.mines = mines;
    }

}

And here is what the config client returns when retreiving the properties from the config server

[
    {
        "someKey": "0someKey",
        "someValue": "Foo"
    },
    {
        "someKey": "1someKey",
        "someValue": "Bar"
    }
]

The values are properly decrypted and the ones without {cypher} are correctly bound. My sample is using SB 1.4 and SC Brixton.SR4.

[dsyer]

I think the problem as described is with client side decryption (not server side). It isn't actually a s-c-config feature anyway, but we might as well diagnose it properly here before we move the discussion.

[ryanjbaxter]

@dsyer so you are thinking that the values are not being decrypted on the server and instead on the client? IE the config that is talked about here? @marcellodesales can you confirm that is the case?

[ryanjbaxter]

I was able to reproduce the problem.

In addition to what I described above I added the same properties locally to application.properties in the client. Now my /env endpoint returns

{
    "profiles": [],
    "server.ports": {
        "local.server.port": 8080
    },
    "decrypted": {
        "mine.mines[0].someKey": "******",
        "mine.mines[1].someKey": "******"
    },
    "configService:https://github.com/ryanjbaxter/config-repo/cypher.properties": {
        "mine.mines[1].someValue": "Bar",
        "mine.mines[0].someValue": "Foo",
        "mine.mines[0].someKey": "******",
        "mine.mines[1].someKey": "******"
    },
    "configService:https://github.com/ryanjbaxter/config-repo/application.yml": {
        "info.description": "Spring Cloud Samples",
        "info.url": "https://github.com/spring-cloud-samples",
        "eureka.client.serviceUrl.defaultZone": "http://localhost:8761/eureka/"
    },
    ...
}

Notice the decrypted property source is missing the someValue properties, those are the ones without the {cypher} prefix.

After talking to @philwebb about this we think this is a Boot issue rather than anything to do with the config server. @philwebb has opened an issue to revisit the problem in SB.

[philwebb]

@ryanjbaxter Can you share the project you used to test this, we'll need it to verify the Boot fix.

[ryanjbaxter]

For the config server I am using https://github.com/spring-cloud-samples/configserver
In the application.yml change config.server.git.uri to point to https://github.com/ryanjbaxter/config-repo.

For the client you can use the app here https://github.com/ryanjbaxter/config-client-446

[philwebb]

@marcellodesales Does that setup match they way you're running things in your app?

[marcellodesales]

@philwebb @ryanjbaxter I think so... As @ryanjbaxter might have figured out, the server setup to NOT decipher secrets. The client has the same jks used to encrypt the values, so the client is decrypting the values.

[ryanjbaxter]

@marcellodesales makes sense, once I introduced the client side decryption that is when the problem showed up, thanks!

[marcellodesales]

@ryanjbaxter awesome... I will keep following the open issue!

[philwebb]

There's not an easy way to fix this in Boot without causing regressions. If EnvironmentDecryptApplicationInitializer could be changed to add both the decrypted values, and any original values as well (i.e. so there's not a split across sources) then I think things will work again.

[marcellodesales]

Awesome! Can't wait for the release!

[marcellodesales]

@spencergibb @ryanjbaxter @dsyer @philwebb We finally verified the patch from #130 ... Worked beautifully! Thank you guys!