Product Documentation
Abstract
IBM Content Navigator 3.0.5 interim fix 1 introduces a new method for encrypting secrets stored in the IBM Content Navigator configuration database.
Content
Prerequisite
Before you upgrade from IBM Content Navigator version 3.0.5 GA or earlier to version 3.0.5 interim fix 1 or later, ensure that one of the following statements is true:
- Your application server is configured to use unlimited policy files.
For more information on using unlimited policy files with an Oracle JRE, refer to the following documentation:
https://www.oracle.com/technetwork/java/javase/downloads/jce-all-download-5170447.html
- Your application server is running one of the following Java versions:
- IBM Java 8 SR5 FP10 or later
- Oracle Java 8u161 or later
Key Encryption Key Synchronization
All IBM Content Navigator servers need to use the same key encryption key (KEK) located in the IBM Content Navigator configuration directory. Check whether the IBM Content Navigator configuration directory is shared with all IBM Content Navigator servers. In case the configuration directory is not shared with all servers, taking the following steps after you install or upgrade IBM Content Navigator to ensure all servers use the same KEK.
- Start one of the IBM Content Navigator servers and open the IBM Content Navigator web client. The KEK and the data encryption keys are generated automatically when they are not found as the web client is opened.
- Back up the KEK by taking the following backup procedures.
- Copy the KEK to the configuration directory in all servers. Extract in case you used the tar command to archive the KEK.
- Start rest of the servers.
Note: The path to the IBM Content Navigator configuration directory is set in the navigator.war/WEB-INF/web.xml file (iviewproConfigurationDirectory parameter) and the taskManagerWeb.war/WEB-INF/config.properties file (icn_config_dir_path parameter) when the Task Manager is configured. An alternative path containing the KEK can be defined by setting a custom Java system property (JVM argument) as in the following example in all IBM Content Navigator servers.
-Dsettings.navigator.default=keyMaterialBasePath=/alternative/path
Backup Procedures
After IBM Content Navigator is installed or before IBM Content Navigator is upgraded, in addition to any other backups procedures you take, ensure that you also back up the KEK.
IBM Content Navigator 3.0.9 or later:
Back up the KEK archive file that has a file extension ending in ika in the IBM Content Navigator configuration directory.
Note: In case the archive file is not found after IBM Content Navigator is upgraded, you can rotate the KEK as described in the following technote for an archive file to be generated.
https://www.ibm.com/support/pages/node/876336
Note: A new archive file is generated every time the KEK is rotated. IBM Content Navigator uses the newest archive file when there are multiple archive files in the IBM Content Navigator configuration directory. The newest archive file is the first file in the list when they are sorted by name in reverse order. You can run the following command to sort the archive files.
- Windows:
dir *.ika /o:-n - Linux and AIX:
ls -l *.ika | sort -r
IBM Content Navigator 3.0.5 interim fix 1 or later but earlier than 3.0.9:
Back up the KEK directory, .ikm, in the IBM Content Navigator configuration directory using the following command.
- Windows:
robocopy .ikm <destination> /copyall - Linux:
orscp -rp .ikm <destination>tar -c -f <filename>.tar -H posix .ikm - AIX:
scp -rp .ikm <destination>
Note: It is important that you pass the command option, /copyall, -rp, or -H, to preserve the full timestamps of the files. On Linux, you can archive the KEK directory by using the tar command in instead of or in addition to copying the directory.
Task Manager Change
Before IBM Content Navigator version 3.0.5 interim fix 1, the Task Manager administrator credentials are stored in the config.properties file located in the taskManager/deploy/WEB-INF directory under the IBM Content Navigator installation directory. After IBM Content Navigator is upgraded, the first time the Task Manager is started, the credentials are migrated to the IBM Content Navigator configuration database.
Review the settings page of the IBM Content Navigator administration desktop to verify that the Task Manager credentials are successfully migrated to the configuration database, then delete the credentials from the config.properties file.
Related Information
Document Location
Worldwide
Was this topic helpful?
Document Information
Modified date:
23 September 2021
UID
ibm10869440