Comment: Remember to update the release version number before publishing externally.
This article includes updates for Smart ID Identity Manager 24.R1 or later.
This article provides guidance and troubleshooting tips for addressing common error scenarios related to the sign and encrypt engine and how to solve them.
Before doing any repair procedures, creating a backup of the Identity Manager applications, configuration files, and database is recommended.
Error messages on startup
Upon startup of Identity Manager you might see one or more error messages like the one below:
Compromised key detected: Descriptor [SelfServiceJWTSigner (version: 1)] in engineSignEncrypt config xml. This is a SECURITY RISK on productive systems. It is ESSENTIAL to replace it with a new secure key.
This means that one or more demo keys, keys that are considered compromised and unfit for productive use, are still in use. Each message indicates the offending descriptor and version from the config XML.
For information about how to replace the keys, see Bootstrapping the sign and encrypt engine.
Replacing the EncryptedFields descriptor's key requires re-encryption of existing secrets via the batch_secretfieldstore_change_encryption_key tool. For more information, see Change encryption key of secret field store.
Replacing the ObjectHistorySigner descriptor's key requires re-signing existing history entries via the batch_re-sign_history tool.
Replacing the ConfigZipSigner descriptor's key means any previously exported encrypted config ZIP files cannot be decrypted anymore, versioning to enable decryption with historical keys is not supported.
Startup fails with exception message
Startup of Identity Manager might fail with an exception message in the log.
Potential causes:
The key configured for the ObjectHistorySigner descriptor in the current version (version 2 in the example error message) is wrong, the wrong P12 file might been configured.
The object history got corrupted by accident or deliberate manipulation, forensic analysis may be advisable.
A quick workaround to restart the application is to switch to a new chain name for idm-operator:
History verification will still fail after the chain name change.
Tomcat deployment: Set chain name in system.properties
... etc. ... commonHistoryService.chainName=NEW_CHAIN_NAME_GOES_HERE ... etc. ...
Docker-deployment: Set chain name in docker-compose.yml
... etc. ...
environment:
... etc. ...
- 'SYSTEM_PROPERTIES={
"commonHistoryService.chainName": "NEW_CHAIN_NAME_GOES_HERE",
... etc. ...
You can solve this properly by re-signing the history entries via the batch_re-sign_history tool.
Error accessing the sign and encrypt engine
Startup of Identity Manager might fail with an exception message like this in the log:
Error accessing the sign and encrypt engine (There's no keystore at classpath:hybridEncKeypair.p12)
This means that the configuration XML for the sign and encrypt engine references a file that does not exist at the given location. All files referenced via the location classpath: usually need to be inside the WEB-INF\classes\ folder of the web application.
In Identity Manager versions before 24.R1, that folder did contain all demo keys, which were since removed. Furthermore, the engineSignEncryptConfig.xml shipped in WAR files of 24.R1 and above references additional P12 files not used or not bootstrapped previously. By default, a dedicated P12 file per descriptor is used instead of sharing files between descriptors.
For more information, see Bootstrapping the sign and encrypt engine to bootstrap any missing keys/certificates.