InvalidCipherTextException Error finalising cipher during CA Identity Manager Decryption

Products

• CA Identity Manager
• CA Identity Suite

Issue/Introduction

When attempting to decrypt passwords or manage JDBC managed objects in CA Identity Manager, the system may fail with an InvalidCipherTextException. This error typically indicates a mismatch or corruption regarding the FIPS key used for encryption/decryption operations.

Symptoms The following error is observed in the logs:

ERROR [com.netegrity.crypto.AESCBCPKCS5PaddingHandler] Exception caught while decrypting.ERROR [com.netegrity.crypto.AESCBCPKCS5PaddingHandler] org.bouncycastle.crypto.InvalidCipherTextException: Error finalising cipher

Additional log context may show the key path: The key path =/com/netegrity/config/keys/FIPSkey.dat

Environment

Identity Manager 14.x

Cause

his issue is caused by an incorrect or mismatched FIPS key (FIPSkey.dat) being used to decrypt entries in the password table.

Resolution

If there is no Provisioning Server involved in your environment, perform the following steps:

1. Access the Identity Manager database.
2. Clear the relevant entries in the password table.
3. Restart the Identity Manager (IDM) service.

Note: If a Provisioning Server is involved, ensure that the FIPS key on the Identity Manager server matches the key used by the Provisioning Server.