We are deploying LakeFS into Azure. Just a curious about what

LAKEFS-ENCRYPT-SECRET

is used for ? We found that if we change that, all user cannot login anymore ... Is that key used to encrypt end user password/secret key ? Edit: I mean

LAKEFS_AUTH_ENCRYPT_SECRET_KEY

Hi @HT, Welcome to the Azure lake! Are you referring to the configuration property auth.encrypt.secret_key? This is used primarily by the auth DB to store secret keys and passwords. Helps prevent various attacks on them if the DB itself leaks, including dictionary and rainbow table attacks. It should be a long random and secret string: if I know your key then there are several attacks I can mount against your database that may allow me to recover keys. IIRC we use the standard bcrypt here. There should be documentation for everything config related on https://docs.lakefs.io/reference/configuration.html. And, as always, please be sure to ask here or open an issue if any configuration property is missing!

I am refering to this one:

Sure, that's the same one! Same page explains how to convert field names in the config file into environment variables - and that's what you get. So you want a long random secret string there, and you cannot change that string. It will be used to protect passwords and secret keys using bcrypt.

We had a situation where: we have lakefs running with users etc The we restarted the server but made a mistake of changing that key. We lost access to our lakefs: cannot login anymore We tried to put back the old key but still cannot logged back in. Is this expected?

Ouch. Unfortunately bcrypt is really good at its job, and AFAIK there is no way to recover data without the key. If you reuse the old key value then you should be back inside.

We do have the old key. We restarted the server and couldn't still get back in

Yes, the key should work. Can you post logs from startup and from a failed connection attempt, please? Or send them to @Lynn Rozen and me, of course.

Ok. Good to know. I will try to retrieve the logs and ideally reproduce the issue (We already re deploy from scratch :p)