Turning up logging for the IdP data sealer

[Cantor, Scott]

On 10/26/20, 2:40 PM, "users on behalf of Wessel, Keith" <users-bounces at shibboleth.net on behalf of kwessel at illinois.edu> wrote:

>    If it has changed, the cron job pulls down the new value and adds it to a pkcs12 keystore using keytool's -importpass
> option. I can't remember now why I went with pkcs12 instead of jceks, but that shouldn't matter. But I'm wondering if
> this isn't what importpass is for. Does anyone have any insight on how to import a string into a secret key?

Is your process maybe trying to artificially assign its own local name for the key or something rather than it being an intrinsic property of the key being imported?

> The IdP is finding the key with the right key alias in the keystore, but it's clearly a mismatched key for the key in the other
> IdP node.

Yes, that is the problem.

-- Scott