Sign and Encrypt engine bootstrap verification

When this article is ready, please put it as a child of Bootstrap the sign and encrypt engine in Identity Manager

Upon startup, IDM Operator and IDM Administrator will perform various checks of the Sign and Encrypt engine's configuration. Depending on the severity, failed checks will lead to log messages or even prevent the system from starting. These checks are carried out:

Check for demo certificates

The default sign and encrypt engine's configuration is convenient to use for development or demonstrations. However, the used keypairs are not secret and thus unsuitable for encrypting or signing. This check will go through all the configured keys of the sign and encrypt engine and check them against a blacklist. The blacklist contains the aforementioned default certificates and keypairs. If a descriptor uses a blacklisted keypair, an error message will be logged with details of the offending descriptor.

If you wish, you can add certificates to the blacklist, e.g. the ones that you used during development of your solution. The blacklist is contained in the file blacklist.p12, the default password is "blacklist"

If this check fails, booting will not be aborted, as this is an acceptable scenario for development, testing and demonstrations. To fix the error, change the keys of the offending descriptors.

Check the Secret Fields Store configuration

Secrets are stored in the Secret Fields Store. If the wrong key is configured, IDM will not be able to decrypt existing secrets. This check makes sure that the correct key is configured.

If this check fails, start up will be aborted. To fix the error, please configure the correct key for the offending descriptor. If you want to change this keypair, please follow the documentation for doing so.

Check the Object History signature configuration

This particular check is performed by IDM Operator only.

IDM signs the history of the objects it manages. When you are using an already existing Object History chain, this check makes sure that certificates for signing and verification of this chain are properly configured in a way that allows the chain to be continued. This means that the certificate and associated keypair used for the last entry of the chain must still be available.

A failure of this test indicates that the descriptors used for the Object History signing are wrong. In this case, start up will be aborted. Please check that the correct certificate/keypair is configured for the descriptor and that the versioning is correct.

If you think that the engine's configuration is correct but you still get this error, you can also recover from this error by configuring a new Object History chain as shown below:

For Tomcat deployment: add the following to WEB-INF/classes/system.properties of the IDM Operator webapp:

# replace NEW_CHAIN with the desired name for the replacement chain
commonHistoryService.chainName=NEW_CHAIN

For Docker deployment: add the following to the start of the SYSTEM_PROPERTIES definition in docker/compose/identitymanager/operator/docker-compose.yml:

# replace NEW_CHAIN with the desired name for the replacement chain
          "commonHistoryService.chainName": "NEW_CHAIN",

Thus, the old chain will remain intact for further analysis. The new chain will be signed with the currently configured descriptor.