Enforce Event - Failed to load database profile - Failed to calculate crypto hash using key EXTERNAL.keynum

Products

• Data Loss Prevention
• Data Loss Prevention Enforce

Issue/Introduction

Enforce reporting event code 2920 intermittently

Directory connection index failed loading on all the detection servers.

Error in the tomcat logs:

Jun 10, 2022 6:00:02 PM com.vontu.profiles.monitor.loader.ProfileOperationalLogger loadFailed
SEVERE: (DETECTION.302) Failed to load profile [27,915:877][AD Connection Name]
com.vontu.profileindex.IndexException: Failed to calculate crypto hash using key EXTERNAL.43.
 at com.vontu.profileindex.database.DatabaseProfileIndexFactory.getKeyContainer(DatabaseProfileIndexFactory.java:276)
 at com.vontu.profileindex.database.DatabaseProfileIndexFactory.getKeyContainer(DatabaseProfileIndexFactory.java:287)
 at com.vontu.profileindex.database.DatabaseProfileIndexFactory.loadInstance(DatabaseProfileIndexFactory.java:251)
 at com.vontu.profiles.monitor.loader.LoadedIndexMap.createDescribedIndex(LoadedIndexMap.java:194)
 at com.vontu.profiles.monitor.loader.LoadedIndexMap.load(LoadedIndexMap.java:172)
 at com.vontu.profiles.monitor.loader.IndexLoaderHelper.loadIndex(IndexLoaderHelper.java:206)
 at com.vontu.profiles.monitor.loader.LoadIndexRequest.run(LoadIndexRequest.java:75)
 at com.vontu.util.concurrent.QueueingTask.performWork(QueueingTask.java:63)
 at com.vontu.util.concurrent.WorkerThread.run(WorkerThread.java:79)
Caused by: com.vontu.security.KeyStorehouseException: Unknown cryptographic key: EXTERNAL.43.
 at com.vontu.security.keystorecontainer.KeyStoreContainer.getKey(KeyStoreContainer.java:125)
 at com.vontu.security.keystorecontainer.FilelessKeyStore.getKey(FilelessKeyStore.java:84)
 at com.vontu.keystorehouse.KeyStorehouse.getKeyContainer(KeyStorehouse.java:308)
 at com.vontu.detection.engine.impl.DetectionEngineImpl.getKeyContainer(DetectionEngineImpl.java:970)
 at com.vontu.profileindex.database.DatabaseProfileIndexFactory.getKeyContainer(DatabaseProfileIndexFactory.java:271)
 ... 8 more
Jun 10, 2022 6:00:02 PM com.vontu.logging.LocalLogWriter write
INFO: Database profile removed. Database profile "AD Connection Name" version 876 was removed.

Enforce Event : 

 

 

Environment

Release : 15.7, 15.8

Component : AD Indexing

Resolution

The actual error is about a "cryptographic key" mismatch problem, The Enforce server uses a "cryptographic key" to unlock the oracle database and encrypt the IDM/EDM/Directory indexes, This same key is sent to the detector servers as well for unlocking the indexes. This key is rotated every 30 days and synced across.

Its trivially fixed by restarting the monitor.