Skip to content

Instantly share code, notes, and snippets.

@paoliniluis
Last active August 1, 2023 23:02
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save paoliniluis/bf86eb4d237985667789529316303167 to your computer and use it in GitHub Desktop.
Save paoliniluis/bf86eb4d237985667789529316303167 to your computer and use it in GitHub Desktop.
How to recover from a "Cannot decrypt encrypted String. Have you changed or forgot to set MB_ENCRYPTION_SECRET_KEY?" issue

What's this?

This is an error that happened between 44 and more recent versions where the secret key that Metabase uses to decrypt the previously encrypted values fails.

Why does it happen?

We still can't replicate the conditions unfortunately.

How to recover?

First, you need to know what Metabase encrypts on the DB:

  • settings table, only the values column
  • metabase_database table, only the details column
  • core_user table, only the settings field

In order to recover the settings:

  • check which settings are encrypted and see which ones you can take to an environment variable instead of being persisted into the DB
  • you might want to remove all rows from that table as Metabase will regenerate all those once it starts again. Please consider that if you have any configuration like SSO group mappings, embedding or other type of keys, you'll have to regenerate those as soon as the server starts again

In order to recover the connections:

  • spin up a new local Metabase server connected to a Postgres database (use this docker-compose to simplify the process.
  • log in with the credentials of that compose file.
  • add the database you have in your production environment locally. Now get into the local Postgres DB and copy-paste the details field into your production DB on the place of the currently encrypted values.

Recover the user settings: delete these values, they'll be recreated once the user logs in again

Finally reboot the instance

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment