# Handling Encryption Keys in SSB Integration **URL:** \ **Category:** IIQ Discussion and Questions\ **Tags:** identityiq\ **Created:** [August 1, 2024, 7:28am UTC](https://developer.sailpoint.com/discuss/t/handling-encryption-keys-in-ssb-integration/75068 "2024-08-01T07:28:03Z")\ **Posts on this page:** 17\ **Page:** 1
**Author:** ![LohithHarish](https://avatars.discourse-cdn.com/v4/letter/l/0ea827/32.png) [@LohithHarish](https://developer.sailpoint.com/discuss/u/LohithHarish)\ **Post date:** [August 1, 2024, 7:28am UTC](https://developer.sailpoint.com/discuss/t/handling-encryption-keys-in-ssb-integration/75068/1 "2024-08-01T07:28:03Z")
Hello Experts,I hope you’re all doing well. We recently integrated SSB for one of our customers and have successfully managed to push Rules, Workflows, and Reports from one environment to another without issues. However, we’ve encountered a challenge with Applications due to differing encryption keys. Note: We have implemented Site-Specific Encryption for enhanced security. Could you please advise if there’s a way to pass decrypted passwords into the target environment so that they can be re-encrypted? Alternatively, if you have any other potential solutions, I would greatly appreciate your suggestions. Thank you in advance! ---
**Author:** ![iamksatish](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/iamksatish/32/26217_2.png) [@iamksatish](https://developer.sailpoint.com/discuss/u/iamksatish)\ **Post date:** [August 1, 2024, 7:33am UTC](https://developer.sailpoint.com/discuss/t/handling-encryption-keys-in-ssb-integration/75068/2 "2024-08-01T07:33:48Z")
@LohithHarish Ideally these should be tokenized and you should have separate target.properities file specific to environment , this would help you ---
**Author:** ![enistriminsait](https://avatars.discourse-cdn.com/v4/letter/e/58f4c7/32.png) [@enistriminsait](https://developer.sailpoint.com/discuss/u/enistriminsait)\ **Post date:** [August 1, 2024, 7:36am UTC](https://developer.sailpoint.com/discuss/t/handling-encryption-keys-in-ssb-integration/75068/3 "2024-08-01T07:36:17Z")
Hi @LohithHarish, with SSB you can use the target files. In this file you can set the token. Usually the tokes are everything could be change in application for different environment: user, pwd, connectionstring, query, configuration ecc.. You can use it for deploy pwds encrypted or not. Better if you store on it encrypted password, for security on first. If you have activated the keystore, you need to set it into iiq.properties, like this: ```auto # file location of the CIB keystore # (override of the default $SPHOME/WEB-INF/classes/iiq.dat ) # #keyStore.file=/example/path/filename keyStore.file = /var/lib/CloudGateway/iiq.dat # encrypted master password # #keyStore.password=1:p+qvPBo4== keyStore.passwordFile = /var/lib/CloudGateway/iiq.cfg ``` ---
**Author:** ![LohithHarish](https://avatars.discourse-cdn.com/v4/letter/l/0ea827/32.png) [@LohithHarish](https://developer.sailpoint.com/discuss/u/LohithHarish)\ **Post date:** [August 1, 2024, 9:45am UTC](https://developer.sailpoint.com/discuss/t/handling-encryption-keys-in-ssb-integration/75068/4 "2024-08-01T09:45:22Z")
Thanks for the swift response @enistri.I’ll give it a try ---
**Author:** ![LohithHarish](https://avatars.discourse-cdn.com/v4/letter/l/0ea827/32.png) [@LohithHarish](https://developer.sailpoint.com/discuss/u/LohithHarish)\ **Post date:** [August 1, 2024, 9:45am UTC](https://developer.sailpoint.com/discuss/t/handling-encryption-keys-in-ssb-integration/75068/5 "2024-08-01T09:45:37Z")
Thanks for the swift response @iamksatish .I’ll give it a try ---
**Author:** ![LohithHarish](https://avatars.discourse-cdn.com/v4/letter/l/0ea827/32.png) [@LohithHarish](https://developer.sailpoint.com/discuss/u/LohithHarish)\ **Post date:** [August 5, 2024, 11:08am UTC](https://developer.sailpoint.com/discuss/t/handling-encryption-keys-in-ssb-integration/75068/6 "2024-08-05T11:08:11Z")
Hi @iamksatish and @enistriminsait. I appreciate you both so much; I was able to pass the passwords by using tokenisation. I’m attempting to deploy an object along with envname.iiq.cfg and envname.iiq.dat files in the ssb subdirectory so that the encrypted password in the object gets decrypted using above files.But I’ve been seeing the following issue when I run the ./build.sh import-custom-delta script.Would you kindly assist me with this? i I’ve tried adding the (iiq.cfg,iiq.dat)files path in iiq.properties as well but it didn’t work ![image](https://global.discourse-cdn.com/sailpoint/original/2X/3/31e131d20e8fea19f21afee67fe320b9f8046b81.jpeg) ![undefined](https://global.discourse-cdn.com/sailpoint/original/2X/4/4d53c15ae287b8a10b90462c50392dd95f64d193.jpeg) ---
**Author:** ![iamksatish](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/iamksatish/32/26217_2.png) [@iamksatish](https://developer.sailpoint.com/discuss/u/iamksatish)\ **Post date:** [August 5, 2024, 11:42am UTC](https://developer.sailpoint.com/discuss/t/handling-encryption-keys-in-ssb-integration/75068/7 "2024-08-05T11:42:24Z")
@LohithHarish Are you sure the file path mentioned in properties file with exact name exists, looks like it doesn’t , can you please recheck or provide the properties file to check. ---
**Author:** ![LohithHarish](https://avatars.discourse-cdn.com/v4/letter/l/0ea827/32.png) [@LohithHarish](https://developer.sailpoint.com/discuss/u/LohithHarish)\ **Post date:** [August 5, 2024, 11:49am UTC](https://developer.sailpoint.com/discuss/t/handling-encryption-keys-in-ssb-integration/75068/8 "2024-08-05T11:49:10Z")
Hello @iamksatish Below is the screenshot of sandbox.iiq.properties file ![undefined](https://global.discourse-cdn.com/sailpoint/original/2X/6/652449d236d5d5f35d511a282edf529a50e176af.jpeg) ---
**Author:** ![LohithHarish](https://avatars.discourse-cdn.com/v4/letter/l/0ea827/32.png) [@LohithHarish](https://developer.sailpoint.com/discuss/u/LohithHarish)\ **Post date:** [August 5, 2024, 12:04pm UTC](https://developer.sailpoint.com/discuss/t/handling-encryption-keys-in-ssb-integration/75068/9 "2024-08-05T12:04:38Z")
I tried copying iiq.cfg,iiq,dat files in external location and referencing them through iiq.properties file and directly including those files in ssb folder as well but it didn’t work. ---
**Author:** ![ashutosh08](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/ashutosh08/32/11459_2.png) [@ashutosh08](https://developer.sailpoint.com/discuss/u/ashutosh08)\ **Post date:** [August 5, 2024, 2:13pm UTC](https://developer.sailpoint.com/discuss/t/handling-encryption-keys-in-ssb-integration/75068/10 "2024-08-05T14:13:32Z")
Hi @LohithHarish, Can you please check if you target environment variable is being set properly to ensure correct property file is being used. Thanks ---
**Author:** ![LohithHarish](https://avatars.discourse-cdn.com/v4/letter/l/0ea827/32.png) [@LohithHarish](https://developer.sailpoint.com/discuss/u/LohithHarish)\ **Post date:** [August 6, 2024, 7:26am UTC](https://developer.sailpoint.com/discuss/t/handling-encryption-keys-in-ssb-integration/75068/11 "2024-08-06T07:26:19Z")
Targetvariables were set accurately @ashutosh08 ![image](https://global.discourse-cdn.com/sailpoint/original/2X/9/959fa1002747720a497892fbfb9f4a9423727a2b.jpeg) ---
**Author:** ![LohithHarish](https://avatars.discourse-cdn.com/v4/letter/l/0ea827/32.png) [@LohithHarish](https://developer.sailpoint.com/discuss/u/LohithHarish)\ **Post date:** [August 6, 2024, 9:50am UTC](https://developer.sailpoint.com/discuss/t/handling-encryption-keys-in-ssb-integration/75068/12 "2024-08-06T09:50:58Z")
Hello @iamksatish @enistriminsait @ashutosh08 The issue has been resolved after setting buildSubset as true in the build.properties file. But a new issue has shown up.If I set keyStoreFile,keyStorePassword as iiq.cfg,iiq.dat files of the current environment, it works seamlessly, but if I get the external environment’s iiq.cfg,dat files, build fails with 2024-08-06T15:08:43,983 **ERROR main sailpoint.api. EncodingUtil:185 Error in isMatch:** **[java] sailpoint.tools. GeneralException: Given the final block is not properly padded. Such issues can arise if a bad key is used during decryption.** ![image](https://global.discourse-cdn.com/sailpoint/original/2X/8/82130f484bcaeed29f78afad0f85665509190194.jpeg) ---
**Author:** ![iamksatish](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/iamksatish/32/26217_2.png) [@iamksatish](https://developer.sailpoint.com/discuss/u/iamksatish)\ **Post date:** [August 6, 2024, 9:55am UTC](https://developer.sailpoint.com/discuss/t/handling-encryption-keys-in-ssb-integration/75068/13 "2024-08-06T09:55:47Z")
@LohithHarish This is expected if your encryption mechanism is different across the environments ---
**Author:** ![LohithHarish](https://avatars.discourse-cdn.com/v4/letter/l/0ea827/32.png) [@LohithHarish](https://developer.sailpoint.com/discuss/u/LohithHarish)\ **Post date:** [August 6, 2024, 10:41am UTC](https://developer.sailpoint.com/discuss/t/handling-encryption-keys-in-ssb-integration/75068/14 "2024-08-06T10:41:37Z")
Yeah got it @iamksatish ---
**Author:** ![LohithHarish](https://avatars.discourse-cdn.com/v4/letter/l/0ea827/32.png) [@LohithHarish](https://developer.sailpoint.com/discuss/u/LohithHarish)\ **Post date:** [August 7, 2024, 6:16am UTC](https://developer.sailpoint.com/discuss/t/handling-encryption-keys-in-ssb-integration/75068/15 "2024-08-07T06:16:14Z")
Hello everyone, I’m wondering if there’s a way to automatically decrypt passwords encrypted with source encryption keys at the time of build, and then re-encrypt them using the target’s encryption keys. For example, when exporting an application, it needs to decrypt the passwords to plain text and then re-encrypt them with the target’s encryption keys. ---
**Author:** ![enistriminsait](https://avatars.discourse-cdn.com/v4/letter/e/58f4c7/32.png) [@enistriminsait](https://developer.sailpoint.com/discuss/u/enistriminsait)\ **Post date:** [August 8, 2024, 5:42pm UTC](https://developer.sailpoint.com/discuss/t/handling-encryption-keys-in-ssb-integration/75068/16 "2024-08-08T17:42:46Z")
Hi @LohithHarish, the guide say that: ![image](https://global.discourse-cdn.com/sailpoint/original/2X/9/941a65351366c234cdb3f7c2bc434e3bef18a6f9.png) So, teorically you cant do what you want. But wit SSB you can manage this, with some limitations. There you can find the guide: [https://community.sailpoint.com/t5/Professional-Services/Services-Standard-Build-SSB-v7-0-2/ta-p/190496?attachment-id=12921](https://community.sailpoint.com/t5/Professional-Services/Services-Standard-Build-SSB-v7-0-2/ta-p/190496?attachment-id=12921) On page 45 you can find the procedure for manage the encryption for multple environment. The limitations are that SSB work only if the keystore’s files are in the default path and you need to stored them in you project. Take a look to the doc, maybe can resolve your requirement ---
**Author:** ![system](https://global.discourse-cdn.com/sailpoint/original/2X/f/f2136700ed5e3703e0b85e02f6be799dacca7735.png) [@system](https://developer.sailpoint.com/discuss/u/system)\ **Post date:** [October 7, 2024, 5:43pm UTC](https://developer.sailpoint.com/discuss/t/handling-encryption-keys-in-ssb-integration/75068/17 "2024-10-07T17:43:36Z")
This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.