Howto: Change the Master Encryption Key Storage Directory in RSA Identity Governance and Lifecycle (IGL)
2 years ago
Originally Published: 2018-03-22
Article Number
000051385
Applies To
RSA Product Set: Identity Governance and Lifecycle
RSA Version/Condition: 7.0.1 and higher
 
Issue
By default, the Master Encryption Key Storage Directory is configured as /home/oracle/security. Starting with IGL 7.0.1, this is now a configurable option.
Resolution
There are two common methods used by WebLogic Installations for setting JVM arguments. These methods may not map to your environment if you use custom scripts for starting a WebLogic application server instance. Consult the WebLogic administrator on how the JVM settings are set for your given environment.The location is controlled by Java system property "rsavialg.security.keydir" which will default to /home/oracle/security. This is configured differently depending on the application server you are using.

Wildfly Standalone (non-clustered) hardware or software appliance

Modify /home/oracle/wildlfy/standalone/configuration/aveksa-standalone-full.xml and adjust the property in this section: 
<system-properties>
    <propertyname="jboss.bind.address.management"value="0.0.0.0"/>
    <propertyname="rsavialg.security.keydir"value="/home/oracle/security"/>
</system-properties>

Wildfly Clustered hardware or software appliance

Modify /home/oracle/wildfly/domain/configuration/domain.xml and adjust the property in this section: 
<system-properties>
    <propertyname="java.net.preferIPv4Stack"value="true"/>
    <propertyname="rsavialg.security.keydir"value="/home/oracle/security"/>
</system-properties>

Websphere, Standalone or Clustered

In the Admin console for WebSphere:
  1. Select the server: Servers -> Server types -> WebSphere application servers -> Select server.
  2. Choose the server used for RSA IGL.
  3. Under the Configuration tab, select Server Infrastructure -> Java and Process Management -> Process Definition.
  4. Under Additional Properties, select Java Virtual Machine -> Custom Properties.
  5. Select New. Name:rsavialg.security.keydir, Value:<directory path for master encryption key>
For example:
(Standalone) rsavialg.security.keydir=<directory path for the master encryption key>
(Cluster) rsavialg.security.keydir=<server and directory path for the master encryption key>

Weblogic, Standalone or Clustered

There are two common methods used by WebLogic Installations for setting JVM arguments. These methods may not map to your environment if you use custom scripts for starting a WebLogic application server instance. Consult the WebLogic administrator on how the JVM settings are set for your given environment.

Edit the WebLogin Domain startup enviroments script

This is typically done on a standalone system and would be required if using the AdminServer as the instance where you are deploying RSA IGL. Edit the setDomainEnv.sh file for the domain in which you will be deploying the RSA IGL application.

For example, from $WEBLOGIC_HOME/user_projects/domains/<domain_name>/bin, add the following settings to the beginning of the setDomainEnv script, where WL_HOME is set.
  
JAVA_OPTIONS="$JAVA_OPTIONS-Drsavialg.security.keydir=<directory path for the master encryption key>"
export JAVA_OPTIONS

Specify JVM arguments within the Admin Console for a server instance

This is typically used if tour servers are managed via NodeManager. From the Admin Console:
  1. Environment -> Servers -> Select server
  2. Configuration tab -> Server Start tab
  3. Add the startup setting -Drsavialg.security.keydir=<directory path for the master encryption key> to the Arguments field.
Notes
Create a secure backup process to back up the keys that are in the Master Encryption Key directory. These keys are generated by RSA IGL and are stored on the file system only. If the keys are lost, any data encrypted with those keys will be irrecoverable. The backup process should also ensure that the keys are not compromised, or otherwise exposed, during the backup or after they are in the backup location.

Anytime that you change the value of the Java system property after the keys have already been created (meaning after you configured the property and brought the system back up), you must bring down the system and move the keys to the new location before bringing up the system again.

Related Articles

Trending Articles

Don't see what you're looking for?