THIS IS A WORK IN PROGRESS!

Smart ID Identity Manager offers support for HSM (Hardware Security Model) for several use cases:

...

• The library is provided with your Identity Manager package or on request.

• The library exists as 32 bit and 64 bit version. Use the 64 bit version with the Identity Manager.

Tomcat Deployment on Windows

To be accessed, the library needs to be available in the PATH environment variable.

...

Copy it to your C:\Windows\System32 folder.

Docker Deployment

For Docker deployment, libjpkcs11.so needs to be mounted into a suitable folder within the container (location depends on the HSM software).

...

...

• descriptor EncryptedFields is used for handling secrets with the Identity Manager SecretFieldStore

• descriptor ConfigZipSigner is used for signing and verifying Identity Manager configuration zip files

• descriptor ObjectHistorySigner is used for signing and verifying the Identity Manager Object History

• descriptor SignEmailDescriptor is used for signing S/MIME mails with MailService Mail service tasks

All four use different HSM certificates, see below in the keys section. The example uses the Utimaco CryptoServer with IDM running on Windows.

...

1. To avoid this, you have these options:

   1. Deploy each Identity Manager webapp on its own dedicated Tomcat instance (Docker deployments always work like this).

      OR

   2. Remove all CMSDK JARs and all BouncyCastle JARs from all webapps' tomcat\<webapp>\WEB-INF\lib folders and place them in tomcat\libs instead (this ensures those JARs are served from the Tomcat common classloader for all webapps).

      1. CMSDK JARs:

         • cmcommon*.jar

         • cmsdk-*.jar

         • common-*.jar

      2. BouncyCastle JARs:

         • bcmail-*.jar

         • bcpgp-*.jar

         • bcpkix-*.jar

         • bcprov-*.jar (including bcprov-ext-*.jar)

Additional information