HCL Commerce Version 9.1.18.0 or later

INTEGRITY_CHECK_FAILED_DURING_DECRYPTION Caused by StringIndexOutOfBoundsException in Solr-based search

You may experience the following error during Solr-based search operations. This issue appears in the search-app logs and accompanied by a decryption failure and a StringIndexOutOfBoundsException.

You might notice similar errors in the search-app log.
[ERROR   ] INTEGRITY_CHECK_FAILED_DURING_DECRYPTION
[5/15/25, 15:17:48:828 UTC] 0000010c AES128Cryptx  E com.ibm.commerce.security.internal.encryption.AES128Cryptx decrypt(String text, String user_key, String encoding, boolean useMac) executionContext: [storeId=41] INTEGRITY_CHECK_FAILED_DURING_DECRYPTION
[ERROR   ] ERR_EXCEPTION
                                 generateResponseFromRespData
                                 java.lang.RuntimeException: java.lang.RuntimeException: java.lang.RuntimeException: javax.ws.rs.WebApplicationException: HTTP 500 Internal Server Error
    at com.ibm.commerce.search.internal.expression.provider.SearchProductEntitlementExpressionProvider.invoke(SearchProductEntitlementExpressionProvider.java:382)

Caused by:
java.lang.StringIndexOutOfBoundsException: begin 70, end -1, length 87
	at com.ibm.commerce.search.internal.expression.provider.SearchProductEntitlementExpressionProvider.invoke(SearchProductEntitlementExpressionProvider.java:382)
	at com.ibm.commerce.search.internal.expression.processor.SearchExpressionProcessor.performSearch(SearchExpressionProcessor.java:569)

Problem

HCL Commerce introduces a new Solr-based search runtime built on Solr 9.7.

  • The Search runtime has transitioned from IBM JDK 8 to OpenJDK 17.

  • A new software stack configuration is introduced and must be explicitly set to open.

  • If the softwareStack is not properly configured, decryption may fail, leading to runtime errors like the one shown above

Solution

To resolve this issue, ensure that the software stack is set to open

  • Docker Compose
    In the env.sh file, set:
    SOFTWARE_STACK=open
    
  • Kubernetes
    In your Vault configuration, set:
    ${VAULT_URL}/${TENANT}/${ENVIRONMENT}/softwareStack = open
    
Note:
  • This issue is specific to environments using Solr-based search in version 9.1.18.0 and later.
  • Failing to set the software stack correctly will result in the search application misbehaving due to encryption/decryption incompatibilities.