Issue
smmigratecds fails with error :
[smuser@172.x.x.x properties]$ smmigratecds.sh -validate -v -p changeit
java.lang.Exception: Unable to load private key using certificate. Exception Message: NativeDB$Access.pbeDecrypt: AES decryption failed
at com.netegrity.smkeydatabase.db.filebased.FileBasedCertificateDataStoreImpl.getPrivateKeyFromDB(FileBasedCertificateDataStoreImpl.java:982)
at com.netegrity.smkeydatabase.db.filebased.FileBasedCertificateDataStoreImpl.switchToMemoryDB(FileBasedCertificateDataStoreImpl.java:2980)
at com.netegrity.smkeydatabase.db.filebased.FileBasedCertificateDataStoreImpl.registerDB(FileBasedCertificateDataStoreImpl.java:539)
at com.netegrity.smkeydatabase.db.filebased.FileBasedCertificateDataStoreImpl.registerDB(FileBasedCertificateDataStoreImpl.java:512)
at com.netegrity.smkeydatabase.db.SMKeyDatabase.registerDB(SMKeyDatabase.java:1587)
at com.netegrity.smkeydatabase.migrate.MigrateFBCDS.<init>(MigrateFBCDS.java:133)
at com.netegrity.smkeydatabase.migrate.MigrateCertificateDataTool.process(MigrateCertificateDataTool.java:258)
at com.netegrity.smkeydatabase.migrate.MigrateCertificateDataTool.main(MigrateCertificateDataTool.java:332)
Environment
New Policy server : 12.52SP1 and above Old Policy server : 12.0 Policy server encryption keys are different between old and new server.
Cause
Steps taken by customer In 12.52 Policy server :
- Renamed the smkeydatabase.properties located at siteminder_home\config\properties to newsmkeydatabase.properties
- Copied smkeydatabase.properties file from r12.0 to r12.52 Policy server to directory siteminder_home\config\properties
- Copied smkeydatabase folder from r12.0 to r12.52 Policy server.
- Edited smkeydatabase.properties to change DBLocation property to point to location of smkeydatabase folder.
Then ran command,
smmigratecds.sh -validate -v -p <password>
where the password "<password>" is for the smkeydatabase password from r12.0 setup.
Now, the issue here is that, the password in the smkeydatabse.properties file is encrypted using Policy server Encryption Key.
But for this case, as the Policy server encryption key were different from r12.0 and r12.52 Policy server, the r12.52 Policy server was not able to decrypt the password encrypted using r12.0 Policy server encryption key.
Resolution
If the Policy server encryption keys are different, you should NOT copy the old smkeydatabase.properties file to the new Policy server.
i.e skip step 1 & 2 above.
The new policy server should use it's own smkeydatabase.properties file.