Error: "The key must not be null" When Starting Tomcat on the Custom Connector Server

Products

• CA Privileged Access Manager (PAM)

Issue/Introduction

The Deploy the Custom Connector Software documentation is being used to configure the Privileged Access Manager (PAM) Custom Connector, but the following errors occur in the logs when starting Tomcat in Windows Service Manager.

SEVERE [main] com.ca.pam.extensions.tcfcryptoutil.util.WindowsRegistry.readRegistry Exception while gettng registry entry: Cannot run program "reg": CreateProcess error=5, Access is denied
SEVERE [main] com.ca.pam.extensions.framework.util.ExtensionEncryption.decryptKeyStorePassword Error decrypting password: null
INFO [main] com.ca.pam.extensions.framework.util.ExtensionEncryption.retrieveEncryptionKey Retrieve the encryption key
SEVERE [main] com.ca.pam.extensions.framework.util.ExtensionEncryption.init Encryption Key does not exist

SEVERE [https-jsse-nio-8443-exec-4] com.ca.pam.extensions.tcfcryptoutil.util.WindowsRegistry.readRegistry Exception while gettng registry entry: Cannot run program "reg": CreateProcess error=5, Access is denied
SEVERE [https-jsse-nio-8443-exec-4] com.ca.pam.extensions.framework.util.ExtensionEncryption.decryptKeyStorePassword [#####] [PAMTargetConnector] Error decrypting password: null
INFO [https-jsse-nio-8443-exec-4] com.ca.pam.extensions.framework.util.ExtensionEncryption.retrieveEncryptionKey Retrieve the encryption key
SEVERE [https-jsse-nio-8443-exec-4] com.ca.pam.extensions.framework.util.ExtensionAuthenticationFilter.validateAuthToken [#####] [PAMTargetConnector] Authorization header cannot be decrypted: 
 org.jose4j.lang.InvalidKeyException: The key must not be null.
  at org.jose4j.jwx.KeyValidationSupport.notNull(KeyValidationSupport.java:72)

Cause

The error will occur for one of the following reasons:

1. The extension.keystore.file value in extension_framework.properties is not in the proper format.
2. The extension.encryption.pwd value in extension_framework.properties has the incorrect password.
3. The Tomcat services were started with localhost, which does not have proper permissions for the crypto library

Resolution

To resolve the issue:

1. Use double backslashes when specifying a Windows directory for the extension.keystore.file value. For example:
   extension.keystore.file=C:\\Program Files\\Apache Software Foundation\\Tomcat\\tcf\\ExampleKeyStore
2. Use configTCF.cmd to encrypt the keystore password and verify it matches the password in extension_framework.properties.
3. Use a local administrator to start the Tomcat services