Managing the Provisioning Server Callback Shared Secret in Identity Manager

Products

• CA Identity Manager
• CA Identity Governance
• CA Identity Portal

Issue/Introduction

The Identity Manager Provisioning Server uses a callback shared secret to secure communication between components. This article provides the procedure for confirming the current shared secret and rotating it using the pwdtools.bat utility.

Environment

Identity Manager 14.5 & 15

Resolution

Step 1: Prepare the Password Utility

1. Navigate to: CA\im\iam suite\im\tools\passwordtool.
2. Right-click pwdtools.bat and edit it to ensure the %JAVA_EXE% attribute points to a valid JRE/JDK path (e.g., C:\Java\jdk1.8.0\jre\bin\java.exe).

Step 2: Encrypt the New Shared Secret

1. Open a Command Prompt (CMD) and map to the passwordtool directory.
2. To encrypt your new password using the PBES algorithm, run: pwdTools -JSAFEKEY -p [YourNewPassword]
3. Copy the resulting encrypted value (e.g., {PBES}:...).

Step 3: Update the Configuration File

1. Back up the existing file located at \iam_im.ear\custom\identitymanager\systemWideProperties.properties.
2. Open the file and locate the IMeTASharedSecret property.
3. Replace the existing encrypted string with the new value generated in Step 2.
4. Save the file and restart the application server to apply the changes.

Note: If FIPS mode is enabled, the secret may be configured differently. Ensure that all IM components share the same FIPS key across installations.

Additional Information

To speak with a customer representative or a Support Engineer see Contact Support. Scroll to the bottom of the page and click on your respective region.