name

Type of storage: pkcs12or HSM.

locationValue

• For docker:

  • For a software keystore: place the keystore under docker/compose/certs before creating the container with docker compose. Then set its location as absolute path, prefixed with file: pointing to the mounted file in/certs,
    for example: locationValue="file:/certs/keystore.p12".
    Note: Default attestation keys referenced from the classpath, e.g. locationValue="classpath:attKeyMobileDef.p12" . Only if you need your own keys does this need to be changed.

  • For an HSM: ensure the PKCS11 library is mounted into the container, then use the container’s path of the PKCS11 library, without filename extension, for example: locationValue="/usr/local/lib/libpkcs11hsm"

• For WAR file deployment: 

  • For a software keystore: place the keystore under WEB-INF/classes and set its location, prefixed with classpath:,
    for example: locationValue="classpath:keystore.p12"

  • For an HSM: use the path of the PKCS11 library, without filename extension,
    for example: locationValue="/usr/local/lib/libpkcs11hsm"

pin

PIN for the keystore or HSM.

To avoid having clear text PINs in this file, the pin should be scrambled.
That can be achieved by setting it with pin.encrypted="1234" instead of pin="1234".

For WAR deployments the pin will then be scrambled on the next (re-)start of Tomcat.

For Docker deployments you need to pre- scramble the pins before the first startup of any IDM webapp container.
This is done by executing docker compose run --rm scramble_sign_encrypt_config
from the docker/compose/identitymanager/bootstrap folder.See also with a dedicated tool while IDM Admin / IDM Operator containers are not running.
See Scramble sensitive data in Identity Manager files for detailsdetailed instructions.