<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Hi Andy,<div class=""><br class=""></div><div class="">No, that command doesn't create a new keystore. It only adds a new encryption key to the existing keystore. <br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On Jul 1, 2020, at 5:11 PM, Andrew Jason Morgan <<a href="mailto:morgan@oregonstate.edu" class="">morgan@oregonstate.edu</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div style="font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; font-family: Arial, Helvetica, sans-serif; font-size: 12pt;" class="">We use the following command to rotate keys on a regular basis:</div><div style="font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; font-family: Arial, Helvetica, sans-serif; font-size: 12pt;" class=""><br class=""></div><div style="font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; font-family: Arial, Helvetica, sans-serif; font-size: 12pt;" class=""><span class="">$IDP_HOME/bin/seckeygen.sh \<br class=""></span><div class=""> --storefile $IDP_HOME/credentials/sealer.jks \<br class=""></div><div class=""> --storepass $STOREPASS \<br class=""></div><div class=""> --versionfile $IDP_HOME/credentials/sealer.kver \<br class=""></div><div class=""> --alias secret<br class=""></div><span class=""></span></div><div style="font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; font-family: Arial, Helvetica, sans-serif; font-size: 12pt;" class=""><br class=""></div><div style="font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; font-family: Arial, Helvetica, sans-serif; font-size: 12pt;" class="">I don't know if it will create a new keystore, though.</div><div style="font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; font-family: Arial, Helvetica, sans-serif; font-size: 12pt;" class=""><br class=""></div><div style="font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; font-family: Arial, Helvetica, sans-serif; font-size: 12pt;" class="">Andy<br class=""></div><div style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><div id="appendonsend" class=""></div><div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt;" class=""><br class=""></div><hr tabindex="-1" style="display: inline-block; width: 1336.71875px;" class=""><div id="divRplyFwdMsg" dir="ltr" class=""><font face="Calibri, sans-serif" style="font-size: 11pt;" class=""><b class="">From:</b><span class="Apple-converted-space"> </span>users <<a href="mailto:users-bounces@shibboleth.net" class="">users-bounces@shibboleth.net</a>> on behalf of prasanna cg <<a href="mailto:prasannacgin@yahoo.in" class="">prasannacgin@yahoo.in</a>><br class=""><b class="">Sent:</b><span class="Apple-converted-space"> </span>Wednesday, July 1, 2020 1:36 PM<br class=""><b class="">To:</b><span class="Apple-converted-space"> </span>Shib Users <<a href="mailto:users@shibboleth.net" class="">users@shibboleth.net</a>><br class=""><b class="">Subject:</b><span class="Apple-converted-space"> </span>Re: Shibboleth v3 - Session HA Questions</font><div class=""> </div></div><div class="" style="word-wrap: break-word; line-break: after-white-space;">Thanks for that Scott ! <div class=""><br class=""></div><div class=""><span class="" style="">I was not able to find any documentations / articles to generate new sealer files for IDP. So was curious to know if there is any backdoor way. </span>I used the logs in DEBUG mode and I don't see any log that stated that the cookie<font class="" face="Menlo"><span class="" style="font-size: 11px;"> was wrapped with a key that is known / available (or anything related to that). At the same time, if </span><span class="" style="font-size: 11px;">I</span><span class="" style="font-size: 11px;"> change my key on one IDP node, create a session and test SSO with other IDP node, it certainly records a log as below and </span></font><span class="" style="font-family: Menlo; font-size: 11px;">enforces for re-authentication</span><div class=""><font class="" face="Menlo"><span class="" style="font-size: 11px;"><br class=""></span></font></div><div class="" style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Menlo;"><span class="" style="font-variant-ligatures: no-common-ligatures;">2020-07-01 19:30:41,186 - INFO [net.shibboleth.utilities.java.support.security.BasicKeystoreKeyStrategy:289] - Key 'secret2' not found</span></div><div class=""><span class="" style="font-family: Menlo; font-size: 11px;">2020-07-01 19:30:41,188 - INFO [net.shibboleth.utilities.java.support.security.DataSealer:218] - Data was wrapped with a key (secret2) no longer available</span></div><div class=""><span class="" style="font-family: Menlo; font-size: 11px;"><br class=""></span></div><div class="">And since I couldn't find if the keys were ever copied across nodes my environment, I merely did a cksum and see them to be common between the IDP nodes. Not sure if that confirms but I am assuming it would have been copied. </div><div class=""><br class=""></div><div class=""> </div><div class=""><div class=""><div class=""><div class=""><br class=""><blockquote type="cite" class=""><div class="">On Jul 1, 2020, at 3:52 PM, Cantor, Scott <<a href="mailto:cantor.2@osu.edu" class="">cantor.2@osu.edu</a>> wrote:</div><br class="x_Apple-interchange-newline"><div class=""><div class="">On 7/1/20, 3:50 PM, "users on behalf of prasanna cg" <<a href="mailto:users-bounces@shibboleth.net" class="">users-bounces@shibboleth.net</a><span class="Apple-converted-space"> </span>on behalf of<span class="Apple-converted-space"> </span><a href="mailto:prasannacgin@yahoo.in" class="">prasannacgin@yahoo.in</a>> wrote:<br class=""><br class=""><blockquote type="cite" class="">Thanks Scott. I understand I am missing something here. Let me look further. Also, Is there a way to create a new / fresh<br class="">"sealer.jks" and “sealer.kver” files in an IDP node ? I am trying to see if I can ignore the ones that exist now and create a<br class="">new file for each of my IDP nodes and test again.<span class="Apple-converted-space"> </span><br class=""></blockquote><br class="">I believe the script that rolls the key can essentially initialize one from empty state, but I'm not positive.<br class=""><br class="">Initially I wrote your question off as "he's nuts?" but you've clearly digested the documentation sufficiently to be questioning reality appropriately.<br class=""><br class="">I would really suggest you just use the logs.<br class=""><br class="">-- Scott<br class=""><br class=""><br class=""><br class=""><br class="">--<span class="Apple-converted-space"> </span><br class="">For Consortium Member technical support, see<span class="Apple-converted-space"> </span><a href="https://wiki.shibboleth.net/confluence/x/coFAAg" class="">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br class="">To unsubscribe from this list send an email to<span class="Apple-converted-space"> </span><a href="mailto:users-unsubscribe@shibboleth.net" class="">users-unsubscribe@shibboleth.net</a><br class=""></div></div></blockquote></div><br class=""></div></div></div></div></div></div><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">--<span class="Apple-converted-space"> </span></span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">For Consortium Member technical support, see<span class="Apple-converted-space"> </span></span><a href="https://wiki.shibboleth.net/confluence/x/coFAAg" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;" class="">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">To unsubscribe from this list send an email to<span class="Apple-converted-space"> </span></span><a href="mailto:users-unsubscribe@shibboleth.net" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;" class="">users-unsubscribe@shibboleth.net</a></div></blockquote></div><br class=""></div></body></html>