PIM Pwextractor error: Could not perform unpadding: invalid pad byte

Document ID : KB000109691
Last Modified Date : 26/09/2018
Show Technical Document Details
Issue:
When trying to return cleartext passwords from the pwextractor utility in PIM an error like the one below is received. Even though the utility continues on and claims to successfully complete. When reviewing the output file it only contains the CSV style header information and no information about accounts.

Sample Error:
Starting passwords extraction for ACCOUNT_PASSWORD...... 
2018-08-02 16:14:58,021 (com.netegrity.crypto.AESCBCPKCS5PaddingHandler) ERROR 
- Exception caught while encrypting. 
2018-08-02 16:14:58,023 (com.netegrity.crypto.AESCBCPKCS5PaddingHandler) ERROR 
- ; com.rsa.jsafe.JSAFE_PaddingException: Could not perform unpadding: invalid p 
ad byte. 
Successfully completed password extraction to file is: c:\production_accounts_pa 
sswd 
Signed file successfully to c:\production_accounts_passwd.sig 
Press any key to continue . . .

Sample file contents:
%CURRENT_PASSWORD@!~CLEAR_TEXT%
%ACCOUNT_HANDLE@!~NEW_PASSWORD@!~PASSWORD_LAST_MODIFIED_DATE

 
Environment:
Any PIM version
Cause:
The problem here is related to the password decryption.This error is usually caused by using the incorrect KIPSkey.dat file when running the pwextractor command. It may also be caused by attempting to use a corrupted FIPSkey.dat file.
Resolution:
To resolve this issue you need to make sure you are using the correct FIPSkey.dat.
  • Check to ensure you are connecting to the correct database.
  • Check to ensure you are running the command from the correct host.
  • If you have a Load Balancing ENTM server set up you can try using the key from there.
  • If you have a backup of the key or host then you can try recovering the key from the backup.
Additional Information:
PWEXTRACTOR documentation:
https://docops.ca.com/ca-privileged-identity-manager/12-9-01/EN/reference/reference-guide/pwextractor-utility-extract-privileged-account-passwords