This procedure helps in resetting the Policy server encryption key that is provided during policy server installation. The value is stored in EncryptionKey.txt
(<Policy_server_install_path>)/bin folder)
This key is used by the Policy server to encrypt and decrypt "sensitive" information that is entered in the
CA SSO (Siteminder) via policy server management console (SMConsole) as well as the CA SSO Policy Server User Interface.
This includes data such as LDAP bind-credentials, ODBC passwords, key-store keys, agent shared secrets etc.
No way for policy servers that use different Encryption key to share same policy store. In order for policy servers to decrypt
the sensitive information within policy store, they need to use the same encryption key. We can change it via smreg -key
<encryption_key>
SiteMinder R12.8.x
In case of unknown encryption key while upgrade / migration procedures this can be useful.
Before performing the encryption key reset , Stop the Policy Server services and take the backup of policy store, key store, Encryptionkey.txt for quick restoration. Below commands can be used for backups.
Policy store full backup command.
xpsexport < export filename.xml> -xb -npass
Example :
xpsexport Policystore_fullbackup.xml -xb -npass
Export keys from key store.
smkeyexport -o<output_file> -d<AdminName> -w<AdminPW> -c