{"record":{"id":"4555506be7013c21","repo":"dgraph-io/dgraph","slug":"flags-acl-secret-key-set-in-both-vault-and-acl-fl","errorCode":null,"errorMessage":"flags: ACL secret key set in both vault and acl flags","messagePattern":"flags: ACL secret key set in both vault and acl flags","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"x/acl_enc_keys.go","lineNumber":62,"sourceCode":"\n\tencKeyFile := encSuperFlag.GetPath(flagEncKeyFile)\n\tif encKeyFile != \"\" {\n\t\tif encKey != nil {\n\t\t\treturn nil, fmt.Errorf(\"flags: Encryption key set in both vault and encryption flags\")\n\t\t}\n\t\tvar err error\n\t\tif encKey, err = os.ReadFile(encKeyFile); err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error reading encryption key from file: %s: %s\", encKeyFile, err)\n\t\t}\n\t}\n\tif l := len(encKey); encKey != nil && l != 16 && l != 32 && l != 64 {\n\t\treturn nil, fmt.Errorf(\"encryption key must have length of 16, 32, or 64 bytes, got %d bytes instead\", l)\n\t}\n\n\taclSecretFile := aclSuperFlag.GetPath(flagAclKeyFile)\n\tif aclSecretFile != \"\" {\n\t\tif aclKey != nil {\n\t\t\treturn nil, fmt.Errorf(\"flags: ACL secret key set in both vault and acl flags\")\n\t\t}\n\t\tvar err error\n\t\tif aclKey, err = os.ReadFile(aclSecretFile); err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error reading ACL secret key from file: %s: %s\", aclSecretFile, err)\n\t\t}\n\t}\n\n\tkeys := &Keys{\n\t\tAclSecretKeyBytes: aclKey,\n\t\tAclAccessTtl:      aclSuperFlag.GetDuration(flagAclAccessTtl),\n\t\tAclRefreshTtl:     aclSuperFlag.GetDuration(flagAclRefreshTtl),\n\t\tEncKey:            encKey,\n\t}\n\n\tif aclKey != nil {\n\t\talgStr := aclSuperFlag.GetString(flagAclJwtAlg)\n\t\taclAlg := jwt.GetSigningMethod(algStr)\n\t\tif aclAlg == nil {","sourceCodeStart":44,"sourceCodeEnd":80,"githubUrl":"https://github.com/dgraph-io/dgraph/blob/759e242be62c91f8d084da06ad0c8d21256d9c07/x/acl_enc_keys.go#L44-L80","documentation":"GetEncAclKeys resolves the ACL super-flag into a signing key. When the HMAC secret is found via the vault-sourced 'acl' super flag AND a key file path is also set (flagAclKeyFile), the key would be specified twice, so the function refuses to guess which one wins and returns this error.","triggerScenarios":"Calling GetEncAclKeys (via dgraph restore/export/alpha/bulk, runRestoreCmd, runExportBackup, openDgraph, RunMapper) when both the vault-delivered acl secret key and the --acl key-file option are non-empty.","commonSituations":"Operators migrating from file-based ACL key config to Vault-based secrets but leaving the old file flag in place; a Helm/daemonset configmap where a leftover acl key file path duplicates a Vault-injected secret.","solutions":["Remove the ACL key-file flag (flagAclKeyFile path) so only the vault-provided key is used","Or remove the ACL secret key from Vault and supply it only via the key file","Audit the composed superflag string for duplicated components","Restart the command after ensuring exactly one key source is configured"],"exampleFix":"// before\n--acl \"hmac-secret-file=/vault/secrets/acl_key;jwt-alg=HS256\" # vault injects key AND file set\n// after\n--acl \"jwt-alg=HS256\" # rely solely on vault-provided hmac secret","handlingStrategy":"validation","validationCode":"// Pre-check your superflag composition: exactly one key source\nkeyFile := flagAclKeyFileValue // from your config\nvaultKeySet := vaultSecretResolved != \"\"\nif keyFile != \"\" && vaultKeySet {\n    return fmt.Errorf(\"configure either key file or vault secret, not both\")\n}\n_, err := x.GetEncAclKeys(aclSuperFlag, encKey) // fail fast at startup","typeGuard":null,"tryCatchPattern":"if _, err := x.GetEncAclKeys(flag, encKey); err != nil {\n    if strings.Contains(err.Error(), \"set in both vault and acl flags\") {\n        // fix config: drop one source\n    }\n    return err\n}","preventionTips":["Keep exactly one canonical source for the ACL secret (Vault recommended)","In deployment templates, remove file-based key flags when enabling Vault injection","Validate the full flag string in CI before rollout"],"tags":["config","acl","flags","vault"],"backgroundTag":"duplicate-secret-key-configuration","analyzedSha":"759e242be62c91f8d084da06ad0c8d21256d9c07","analyzedAt":"2026-09-01T14:42:12.034Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}