MyCATApache/Mycat-Server · error · ConfigException

host ,user passwrod need to decrype ,but decrype password…

Error message

host {host},user {user} passwrod need to decrype ,but decrype password is wrong !

What it means

DBHostDecrypt.decrypt() in Mycat's DecryptUtil parses user password strings of the form 'encrypted:user:password:host:index'. When the flag marker says the password should be decryptable but Base64/3DES decryption of the password segment fails (or throws any exception), it wraps the cause in a Mycat ConfigException naming the host and user.

Solutions

1. Encrypt the password with Mycat's own encryption tool (DecryptUtil.encode / conf wrapper script) so the ciphertext matches the expected 3DES key and format
2. Verify the full credential string has all 5 colon-separated segments and the encrypted password is valid Base64 (length multiple of 4)
3. If you intend a plain-text password, generate the entry without encryption instead of pasting raw text into the encrypted field
4. Enable debug logging of the underlying exception (e2) to confirm whether it is BadPadding, IllegalBlockSize, or Base64 decode failure

Example fix

// before
<property name="password">myPlainPassword</property>
// after
<property name="password">encryptedPasswordProducedByMycatEncodeTool</property>

static boolean isEncryptedEntry(String entry){
    if(entry==null) return false;
    String[] p = entry.split(":");
    if(p.length < 5 || !"encrypted".equalsIgnoreCase(p[0])) return true; // plain text ok
    try { java.util.Base64.getDecoder().decode(p[3]); return true; }
    catch(IllegalArgumentException e){ return false; }
}

try { pwd = DecryptUtil.decrypt(entry); }
catch (ConfigException e) { LOG.error("bad encrypted password for host/user", e); throw new IllegalArgumentException("re-encrypt password with Mycat tool", e); }

When it happens

Trigger: Calling DecryptUtil.decrypt() (directly or via datahost config loading) with a password string where the 4th segment is not a valid Base64-encoded 3DES ciphertext, or the encrypted blob was produced with a different key than the one DecryptUtil uses.

Common situations: Users hand-edit schema.xml/server.xml and paste a plain-text password where an encrypted one is expected; encrypted passwords copied between environments with different encryption keys; truncated Base64 from copy/paste; typo like 'passwrod' fields misused.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• Initial capacity exceeds maximum capacity of
• Page size cannot exceed
• bufferSize must not be less than 1
• bufferSize must be a power of 2
• Failed to parse time string

AI-assisted analysis of MyCATApache/Mycat-Server@65f8d8beb7 (2026-09-11). Data as JSON: /api/errors/9deb7e6bc9e6eedb. Report an issue: GitHub.

Appendix: source

Thrown at src/main/java/io/mycat/util/DecryptUtil.java:111

			}
		}
		return passwrod;
	}
	public static String DBHostDecrypt(String usingDecrypt,String host,String user ,String passwrod){
		if("1".equals(usingDecrypt)||"true".equalsIgnoreCase(usingDecrypt)){
			//type:host:user:password
        	//1:myhost1:test:test
        	boolean flag = false;
        	try {
        		String passwrods[] = DecryptUtil.decrypt(passwrod).split(":");
            	if("1".equals(passwrods[0]) && host.equals(passwrods[1]) && user.equals(passwrods[2])){
            		return passwrods[3];
            	}
            	if(flag==false){
            		 throw new ConfigException("user " + user + " passwrod need to decrype ,but decrype password is wrong !");
            	}
        	} catch (Exception e2) {
       		    throw new ConfigException("host " + host + ",user " + user + " passwrod need to decrype ,but decrype password is wrong !",e2);
			}
		}
		return passwrod;
	}
	

	public static String decrypt(String cipherText) throws Exception {
		return decrypt((String) null, cipherText);
	}

	public static String decrypt(String publicKeyText, String cipherText)
			throws Exception {
		PublicKey publicKey = getPublicKey(publicKeyText);

		return decrypt(publicKey, cipherText);
	}

	public static PublicKey getPublicKey(String publicKeyText) {

View on GitHub (pinned to 65f8d8beb7)