Decrypting Weblogic Password

How to Decrypt WebLogic Admin Passwords Using WLST in Oracle EBS and WebLogic Server

Forgetting the Oracle WebLogic Server Admin password or inheriting a system with undocumented credentials is a common challenge for System Administrators and Oracle Middleware DBAs. 

 When WebLogic services start up, credentials stored in the 'boot.properties' file are automatically encrypted using AES/Triple-DES keys tied specifically to that WebLogic domain. If you ever need to recover the original plain-text password without triggering a full password reset, you can decrypt the hash directly using the WebLogic Scripting Tool (WLST). 

 In this guide, we will break down how WebLogic domain encryption works and walk through a step-by-step process to recover your WebLogic password. 

1. How WebLogic Encryption Works

To safely decrypt a WebLogic password, it helps to understand the underlying security architecture:

1. boot.properties: Located within your WebLogic server domain directory (e.g., servers/AdminServer/security/boot.properties). It contains the username and password variables. When the AdminServer boots for the first time, WebLogic converts plain-text values into encrypted hash strings (prefixed with {AES} or {3DES}).

2. SerializedSystemIni.dat: Located in the domain's $DOMAIN_HOME/security folder. This binary file holds the domain-specific secret encryption key.

Crucial Security Note: WebLogic passwords cannot be decrypted using boot.properties alone. The decryption utility must run against the specific SerializedSystemIni.dat file from the exact domain where the password was encrypted.

2. Step-by-Step Password Decryption Process 

Follow these precise steps to extract and decrypt your WebLogic Admin password.

Step 1: Locate and Back Up boot.properties 

Navigate to the AdminServer security folder and back up the boot.properties file:

# Example path pattern for Oracle EBS R12.2 / WebLogic Domain

cd $EBS_DOMAIN_HOME/servers/AdminServer/security

# Create a backup

cp boot.properties boot.properties.bak

Open boot.properties to view the encrypted password string:

# Example boot.properties file content

username={AES}gq1A93kK0xL1...

password={AES}e12M9L4kP9xLzQv8nS3jE2wK1aB0cD3e=

Copy the entire encrypted password value, including the {AES}.

Step 2: Set Up Environment Variables and Launch WLST

Set your domain environment variables so Java and WebLogic libraries are loaded into your shell session, then invoke wlst.sh:

# Source the WebLogic domain environment

cd $DOMAIN_HOME/bin

. ./setDomainEnv.sh

# Launch the WebLogic Scripting Tool (WLST)

$FMW_HOME/oracle_common/common/bin/wlst.sh

(For standard standalone WebLogic environments, you can also launch WLST directly via $ORACLE_HOME/oracle_common/common/bin/wlst.sh.)

Step 3: Run the Python Decryption Commands in WLST

Once the wls:/offline> prompt appears, pass the exact path to your domain directory, initialize the ClearOrEncryptedService Java class, and print the decrypted output:

# 1. Define the absolute path to your WebLogic Domain directory

wls:/offline> domain = "/u01/oracle/TESTR122/fs1/FMW_Home/user_projects/domains/EBS_domain"

# 2. Get the encryption service bound to the domain's SerializedSystemIni.dat file

wls:/offline> service = weblogic.security.internal.SerializedSystemIni.getEncryptionService(domain)

# 3. Initialize the ClearOrEncryptedService wrapper

wls:/offline> encryption = weblogic.security.internal.encryption.ClearOrEncryptedService(service)

# 4. Decrypt the password string (replace with your actual encrypted hash)

wls:/offline> print encryption.decrypt("{AES}e12M9L4kP9xLzQv8nS3jE2wK1aB0cD3e=")

Expected Output

The terminal will output the plain-text password on the next line:

Welcome123

wls:/offline>

Type exit() to leave the WLST console. You can now use this decrypted password to log into the WebLogic Admin Console or start your application servers.

3. Common Errors and Troubleshooting 

Error 1: EncryptionException: Decryption failed

If WLST returns a weblogic.security.internal.encryption.EncryptionException, check the following:

• Mismatched Domain Path: Ensure the domain variable points to the exact domain folder containing the security/SerializedSystemIni.dat file used when the password was encrypted.

• Incomplete Hash Copy: Ensure you copied the full hash string from boot.properties, including special characters like trailing equals signs (=).

Error 2: NameError: name 'weblogic' is not defined

If WLST cannot locate the weblogic.security.internal package, your environment variables were not loaded properly. Exit WLST, execute . ./setDomainEnv.sh from $DOMAIN_HOME/bin, and rerun wlst.sh.







4. Best Practices for WebLogic Password Management

• Maintain Secure File Permissions: Ensure the security/ directory and boot.properties files are owned by the oracle/applmgr OS user with strict read/write permissions (chmod 600 boot.properties).
• Source Control Safety: Never commit boot.properties or SerializedSystemIni.dat files to public code repositories, as anyone with access to both can easily decrypt your infrastructure credentials.

****************************நன்றி****************************