<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
We use the following command to rotate keys on a regular basis:</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span>$IDP_HOME/bin/seckeygen.sh \<br>
</span>
<div> --storefile $IDP_HOME/credentials/sealer.jks \<br>
</div>
<div> --storepass $STOREPASS \<br>
</div>
<div> --versionfile $IDP_HOME/credentials/sealer.kver \<br>
</div>
<div> --alias secret<br>
</div>
<span></span></div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
I don't know if it will create a new keystore, though.</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Andy<br>
</div>
<div>
<div id="appendonsend"></div>
<div style="font-family:Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font style="font-size:11pt" face="Calibri, sans-serif" color="#000000"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of prasanna cg <prasannacgin@yahoo.in><br>
<b>Sent:</b> Wednesday, July 1, 2020 1:36 PM<br>
<b>To:</b> Shib Users <users@shibboleth.net><br>
<b>Subject:</b> Re: Shibboleth v3 - Session HA Questions</font>
<div> </div>
</div>
<div class="" style="word-wrap:break-word; line-break:after-white-space">Thanks for that Scott !
<div class=""><br class="">
</div>
<div class=""><span class="" style="color:rgb(0,0,0)">I was not able to find any documentations / articles to generate new sealer files for IDP. So was curious to know if there is any backdoor way. </span>I used the logs in DEBUG mode and I don't see any log
that stated that the cookie<font class="" face="Menlo" color="#000000"><span class="" style="font-size:11px"> was wrapped with a key that is known / available (or anything related to that). At the same time, if </span><span class="" style="font-size:11px">I</span><span class="" style="font-size:11px"> change
my key on one IDP node, create a session and test SSO with other IDP node, it certainly records a log as below and </span></font><span class="" style="color:rgb(0,0,0); font-family:Menlo; font-size:11px">enforces for re-authentication</span>
<div class=""><font class="" face="Menlo" color="#000000"><span class="" style="font-size:11px"><br class="">
</span></font></div>
<div class="" style="margin:0px; font-stretch:normal; font-size:11px; line-height:normal; font-family:Menlo; color:rgb(0,0,0)">
<span class="" style="font-variant-ligatures:no-common-ligatures">2020-07-01 19:30:41,186 - INFO [net.shibboleth.utilities.java.support.security.BasicKeystoreKeyStrategy:289] - Key 'secret2' not found</span></div>
<div class=""><span class="" style="color:rgb(0,0,0); font-family:Menlo; font-size:11px">2020-07-01 19:30:41,188 - INFO [net.shibboleth.utilities.java.support.security.DataSealer:218] - Data was wrapped with a key (secret2) no longer available</span></div>
<div class=""><span class="" style="color:rgb(0,0,0); font-family:Menlo; font-size:11px"><br class="">
</span></div>
<div class="">And since I couldn't find if the keys were ever copied across nodes my environment, I merely did a cksum and see them to be common between the IDP nodes. Not sure if that confirms but I am assuming it would have been copied. </div>
<div class=""><br class="">
</div>
<div class=""> </div>
<div class="">
<div class="">
<div class="">
<div><br class="">
<blockquote type="cite" class="">
<div class="">On Jul 1, 2020, at 3:52 PM, Cantor, Scott <<a href="mailto:cantor.2@osu.edu" class="">cantor.2@osu.edu</a>> wrote:</div>
<br class="x_Apple-interchange-newline">
<div class="">
<div class="">On 7/1/20, 3:50 PM, "users on behalf of prasanna cg" <<a href="mailto:users-bounces@shibboleth.net" class="">users-bounces@shibboleth.net</a> on behalf of
<a href="mailto:prasannacgin@yahoo.in" class="">prasannacgin@yahoo.in</a>> wrote:<br class="">
<br class="">
<blockquote type="cite" class="">Thanks Scott. I understand I am missing something here. Let me look further. Also, Is there a way to create a new / fresh<br class="">
"sealer.jks" and “sealer.kver” files in an IDP node ? I am trying to see if I can ignore the ones that exist now and create a<br class="">
new file for each of my IDP nodes and test again. <br class="">
</blockquote>
<br class="">
I believe the script that rolls the key can essentially initialize one from empty state, but I'm not positive.<br class="">
<br class="">
Initially I wrote your question off as "he's nuts?" but you've clearly digested the documentation sufficiently to be questioning reality appropriately.<br class="">
<br class="">
I would really suggest you just use the logs.<br class="">
<br class="">
-- Scott<br class="">
<br class="">
<br class="">
<br class="">
<br class="">
-- <br class="">
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" class="">
https://wiki.shibboleth.net/confluence/x/coFAAg</a><br class="">
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" class="">
users-unsubscribe@shibboleth.net</a><br class="">
</div>
</div>
</blockquote>
</div>
<br class="">
</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>