Lenses secret provider AES256 for debezium

General
1

Hello.

I try to setup lenses secret provider AES256 for debezium.

I downloaded secret-provider-2.3.0-all.jar and added properties to my kafka connect configuration file

config.providers=aes256
config.providers.aes256.class=io.lenses.connect.secrets.providers.Aes256DecodingProvider
config.providers.aes256.param.aes256.key=aaaaaaaaaabbbbbbbbbbccccccccccdd

I tried to get encrypted value for name = alex using openssl for example

“${aes256::U2FsdGVkX1/n/e5F51Qd0ofZv6Vcf91m69ifehTwwcc=}”,

But everytime I get an error

[2025-08-03 16:53:43,353] INFO REST resources initialized; server is started and ready to handle requests (org.apache.kafka.connect.runtime.rest.RestServer:303)
[2025-08-03 16:53:43,353] INFO Kafka Connect started (org.apache.kafka.connect.runtime.Connect:77)
[2025-08-03 16:55:10,915] ERROR Uncaught exception in REST call to /connectors/ (org.apache.kafka.connect.runtime.rest.errors.ConnectExceptionMapper:65)
org.apache.kafka.connect.errors.ConnectException: Failed to decrypt the secret.
at io.lenses.connect.secrets.providers.Aes256DecodingProvider.$anonfun$get$1(Aes256DecodingProvider.scala:43)
at scala.util.Failure.fold(Try.scala:256)
at io.lenses.connect.secrets.providers.Aes256DecodingProvider.decrypt$1(Aes256DecodingProvider.scala:44)
at io.lenses.connect.secrets.providers.Aes256DecodingProvider.$anonfun$get$4(Aes256DecodingProvider.scala:63)
at scala.collection.StrictOptimizedIterableOps.map(StrictOptimizedIterableOps.scala:100)
at scala.collection.StrictOptimizedIterableOps.map$(StrictOptimizedIterableOps.scala:87)
at scala.collection.convert.JavaCollectionWrappers$JSetWrapper.map(JavaCollectionWrappers.scala:215)
at io.lenses.connect.secrets.providers.Aes256DecodingProvider.get(Aes256DecodingProvider.scala:63)
at org.apache.kafka.common.config.ConfigTransformer.transform(ConfigTransformer.java:103)
at org.apache.kafka.connect.runtime.WorkerConfigTransformer.transform(WorkerConfigTransformer.java:59)
at org.apache.kafka.connect.runtime.WorkerConfigTransformer.transform(WorkerConfigTransformer.java:54)
at org.apache.kafka.connect.runtime.AbstractHerder.validateConnectorConfig(AbstractHerder.java:660)
at org.apache.kafka.connect.runtime.AbstractHerder.lambda$validateConnectorConfig$3(AbstractHerder.java:579)
at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:545)
at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:328)
at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1095)
at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:619)
at java.base/java.lang.Thread.run(Thread.java:1447)
Caused by: java.lang.IllegalStateException: Invalid format: missing initialization vector
at io.lenses.connect.secrets.providers.InitializationVector$.extractInitialisationVector(Aes256DecodingHelper.scala:96)
at io.lenses.connect.secrets.providers.Aes256DecodingHelper.decrypt(Aes256DecodingHelper.scala:48)
at io.lenses.connect.secrets.providers.Aes256DecodingProvider.decrypt$1(Aes256DecodingProvider.scala:41)
… 15 more

Please help me to generate correct AES256 encrypted value for name = alex.

openssl linux commamd would be preffered for this.

2

Hello Alex, welcome!

I think the issue might be that the secret provider is using AES-256-CBC behind the scenes, and the key refers to the raw key used for the encryption.

I cannot guarantee that it will work, but I would try this:

# Convert the 32-byte key to hex for OpenSSL
KEY=aaaaaaaaaabbbbbbbbbbccccccccccdd
KEY_HEX=$(echo -n "$KEY" | xxd -p -c 32)

# Generate a 16-byte random IV in hex
IV=$(openssl rand -hex 16)

# Now encrypt the secret with openssl:
echo -n "alex" | openssl enc -e -aes-256-cbc -K $KEY_HEX -iv $IV -nosalt -base64
3

Marios, thanks for explanation.

I got the encrypted value using your script, but again the same error:

[2025-08-07 12:15:33,241] ERROR Uncaught exception in REST call to /connectors/ (org.apache.kafka.connect.runtime.rest.errors.ConnectExceptionMapper:65)
org.apache.kafka.connect.errors.ConnectException: Failed to decrypt the secret.
at io.lenses.connect.secrets.providers.Aes256DecodingProvider.$anonfun$get$1(Aes256DecodingProvider.scala:43)
at scala.util.Failure.fold(Try.scala:256)
at io.lenses.connect.secrets.providers.Aes256DecodingProvider.decrypt$1(Aes256DecodingProvider.scala:44)
at io.lenses.connect.secrets.providers.Aes256DecodingProvider.$anonfun$get$4(Aes256DecodingProvider.scala:63)
at scala.collection.StrictOptimizedIterableOps.map(StrictOptimizedIterableOps.scala:100)
at scala.collection.StrictOptimizedIterableOps.map$(StrictOptimizedIterableOps.scala:87)
at scala.collection.convert.JavaCollectionWrappers$JSetWrapper.map(JavaCollectionWrappers.scala:215)
at io.lenses.connect.secrets.providers.Aes256DecodingProvider.get(Aes256DecodingProvider.scala:63)
at org.apache.kafka.common.config.ConfigTransformer.transform(ConfigTransformer.java:103)
at org.apache.kafka.connect.runtime.WorkerConfigTransformer.transform(WorkerConfigTransformer.java:59)
at org.apache.kafka.connect.runtime.WorkerConfigTransformer.transform(WorkerConfigTransformer.java:54)
at org.apache.kafka.connect.runtime.AbstractHerder.validateConnectorConfig(AbstractHerder.java:660)
at org.apache.kafka.connect.runtime.AbstractHerder.lambda$validateConnectorConfig$3(AbstractHerder.java:579)
at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:545)
at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:328)
at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1095)
at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:619)
at java.base/java.lang.Thread.run(Thread.java:1447)
Caused by: java.lang.IllegalStateException: Invalid format: missing initialization vector
at io.lenses.connect.secrets.providers.InitializationVector$.extractInitialisationVector(Aes256DecodingHelper.scala:96)
at io.lenses.connect.secrets.providers.Aes256DecodingHelper.decrypt(Aes256DecodingHelper.scala:48)
at io.lenses.connect.secrets.providers.Aes256DecodingProvider.decrypt$1(Aes256DecodingProvider.scala:41)
… 15 more

I think that cause of this in exception - Invalid format: missing initialization vector

I didn’t find in documentation the place where I need to set IV parameter in config files of kafka connector.

Please help to define place for initialization vector setting.