Update Database Username/password/DSN steps for Advanced Authentication

Products

• CA Advanced Authentication
• CA Strong Authentication
• CA Risk Authentication

Issue/Introduction

What are the changes required for CA Advanced Authentication setup if Database Password or Database Username or Database DSN is changed?

Environment

Release: 9.1.x
Component: CA Advanced Authentication (Strong Authentication and Risk Authentication)

Resolution

For Strong Authentication and Risk Authentication:

Database password is stored in encrypted format in ARCOT_HOME/conf/securestore.enc file. This file stores the following encrypted information for connecting to the Strong Auth and Risk Auth database:

Database user name and password (Used by Strong Auth and Risk Auth Server to connect to the database.)

Master key (Used for encrypting the database user name and password that is stored in securestore.enc.)

To add a new database user name, password, or DSN any time after Installation, use the DBUtil tool to perform these tasks.

DBUtil provides multiple options to change or insert new entries, in case of database password change only below command can be used-

 Navigate to the directory ARCOT_HOME/tool/<OS> to locate the DBUtil utility and run the following command

Syntax:

dbutil -pu <key> <value>

For example:

dbutil -pu <AADatabaseDSN> <newPassword>

dbutil -pu <DBUSer> <newPassword>

 

Note :

1. DSN name is stored in ARCOT_HOME/conf/arcotcommon.ini file under section [arcot/db/primarydb] for Primary Database and under section [arcot/db/backupdb] for backup Database.

 

2. In arcotcommon.ini file, when Datasource.1 is set, we should use datasource name to update the DB password, 

i.e. dbutil -pu <AADatabaseDSN> <newPassword>

 

3. If the password contains special char, 

 -- on windows, the password needs to be enclosed with double quotes. For example, 

dbutil -pu <AADatabaseDSN> "<newPassword>"

 -- on linux, the password needs to be enclosed with single quostes. For example,

dbutil -pu <AADatabaseDSN> '<newPassword>'

 

4. On Linux, need to source the arwfenv before run the dbutil command,

source arwfenv

or

. ./arwfenv

 

5. Restart the application server to take effect. On Linux, same as 4, we need to source the arwfenv before restart the application server.

 

6. If there are multiple servers (connecting to same database), besides running dbutil on each server, you can also copy the good securestore.enc file to other servers.

Additional Information

"DBUtil" Documentation for reference:

https://techdocs.broadcom.com/us/en/symantec-security-software/identity-security/advanced-authentication/9-1/administrating/administrating-ca-risk-authentication/administration-tools/dbutil.html