| Info |
|---|
This article is valid for Smart ID Identity Manager 24.R1 or later. |
...
| Info |
|---|
Descriptor included in default configuration. Correct bootstrapping is required for productive use. Only dev- and test systems may use placeholders (for example created with bootstrap.zip package or the corresponding Docker container). |
Use-case
...
Encryption and decryption of fields in the Identity Manager database
Required
...
Always
Configured in the following applications
...
Identity Manager Admin (previously know as PRIME Designer) David Banz can we remove PRIME from here (and everywhere in the article) or it needs to stay?
Identity Manager Operator (previously known as PRIME Explorer)
Configured in these special-case tools
...
batch_secretfieldstore_change_encryption_key
(repair tool for secret fields)
batch_migration_smartact_to_prime
(for migration of data from Identity Manager's/PRIME's predecessor SmartAct, it has additional requirements for decrypting secret fields and config entries from the source system)
Storage
...
HSM (recommended), pkcs12,
Versioning
...
Not supported, always uses version 1
Supported asymClipher values
...
For HSM
RSA/ECB/OAEPWithSHA-384AndMGF1PaddingRSA/ECB/OAEPWithSHA-512AndMGF1Padding
...
RSA/None/OAEPWithSHA384AndMGF1PaddingRSA/None/OAEPWithSHA512AndMGF1Padding
General requirements
...
Placeholder keys/certs forbidden for productive use
confidentiality of database secrets would be at risk
the key can only be changed with the tool batch_secretfieldstore_change_encryption_key once the first secret is stored in the database
Key requirements
...
Supported types
...
RSA 2048
RSA 3072
RSA 4096 (recommended)
Certificate requirements
...
No special requirements, as only the key-pair is used
may be self-signed
key usage is not checked (recommended for informational purposes: set dataEncipherment)
validity is ignored
certificate does not need to be trusted
...