Page Comparison

name

Type of storage: pkcs12or HSM.

locationValue

• For docker:

  • For a software keystore: place the keystore under docker/compose/certs before creating the container with docker compose. Then set its location as absolute path, prefixed with file: pointing to the mounted file in/certs,
    for example: locationValue="file:/certs/keystore.p12".
    Note: Default attestation keys referenced from the classpath, e.g. locationValue="classpath:attKeyMobileDef.p12" . Only if you need your own keys does this need to be changed.

  • For an HSM: ensure the PKCS11 library is mounted into the container, then use the container’s path of the PKCS11 library, without filename extension, for example: locationValue="/usr/local/lib/libpkcs11libpkcs11hsm"

• For WAR file deployment: 

  • For a software keystore: place the keystore under WEB-INF/classes and set its location, prefixed with classpath:,
    for example: locationValue="classpath:keystore.p12"

  • For an HSM: use the path of the PKCS11 library, without filename extension,
    for example: locationValue="/usr/local/lib/libpkcs11libpkcs11hsm"

pin

PIN for the keystore or HSM.

To avoid having clear text PINs in this file, the pin should be scrambled.
That can be achieved by setting it with pin.encrypted="1234" instead of pin="1234".

In case of docker deployments pre-processing needs to be See you need to pre-scramble the pins before the first startup of IDM webapp containers.
From the docker/compose/identitymanager/bootstrap folder run this command:
docker compose run --rm scramble_sign_encrypt_config

See also Scramble sensitive data in Identity Manager files for details.