<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Thanks for that Scott ! <div class=""><br class=""></div><div class=""><span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);" class="">I was not able to find any documentations / articles to generate new sealer files for IDP. So was curious to know if there is any backdoor way. </span>I used the logs in DEBUG mode and I don't see any log that stated that the cookie<font color="#000000" face="Menlo" class=""><span style="font-size: 11px;" class=""> was wrapped with a key that is known / available (or anything related to that). At the same time, if </span><span style="caret-color: rgb(0, 0, 0); font-size: 11px;" class="">I</span><span style="font-size: 11px;" class=""> change my key on one IDP node, create a session and test SSO with other IDP node, it certainly records a log as below and </span></font><span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-family: Menlo; font-size: 11px;" class="">enforces for re-authentication</span><div class=""><font color="#000000" face="Menlo" class=""><span style="font-size: 11px;" class=""><br class=""></span></font></div><div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Menlo; color: rgb(0, 0, 0);" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">2020-07-01 19:30:41,186 - INFO [net.shibboleth.utilities.java.support.security.BasicKeystoreKeyStrategy:289] - Key 'secret2' not found</span></div><div class=""><span style="color: rgb(0, 0, 0); font-family: Menlo; font-size: 11px;" class="">2020-07-01 19:30:41,188 - INFO [net.shibboleth.utilities.java.support.security.DataSealer:218] - Data was wrapped with a key (secret2) no longer available</span></div><div class=""><span style="color: rgb(0, 0, 0); font-family: Menlo; font-size: 11px;" class=""><br class=""></span></div><div class="">And since I couldn't find if the keys were ever copied across nodes my environment, I merely did a cksum and see them to be common between the IDP nodes. Not sure if that confirms but I am assuming it would have been copied. </div><div class=""><br class=""></div><div class=""> </div><div class=""><div class=""><div class=""><div><br class=""><blockquote type="cite" class=""><div class="">On Jul 1, 2020, at 3:52 PM, Cantor, Scott <<a href="mailto:cantor.2@osu.edu" class="">cantor.2@osu.edu</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="">On 7/1/20, 3:50 PM, "users on behalf of prasanna cg" <<a href="mailto:users-bounces@shibboleth.net" class="">users-bounces@shibboleth.net</a> on behalf of <a href="mailto:prasannacgin@yahoo.in" class="">prasannacgin@yahoo.in</a>> wrote:<br class=""><br class=""><blockquote type="cite" class="">Thanks Scott. I understand I am missing something here. Let me look further. Also, Is there a way to create a new / fresh<br class="">"sealer.jks" and “sealer.kver” files in an IDP node ? I am trying to see if I can ignore the ones that exist now and create a<br class=""> new file for each of my IDP nodes and test again. <br class=""></blockquote><br class="">I believe the script that rolls the key can essentially initialize one from empty state, but I'm not positive.<br class=""><br class="">Initially I wrote your question off as "he's nuts?" but you've clearly digested the documentation sufficiently to be questioning reality appropriately.<br class=""><br class="">I would really suggest you just use the logs.<br class=""><br class="">-- Scott<br class=""><br class=""><br class=""><br class=""><br class="">-- <br class="">For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" class="">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br class="">To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" class="">users-unsubscribe@shibboleth.net</a><br class=""></div></div></blockquote></div><br class=""></div></div></div></div></body></html>