Site Specific Encryption

Which IIQ version are you inquiring about?

Version 8.3

Share all details related to your problem, including any error messages you may have received.

Hello Everyone,

We’re trying to implement site-specific encryption for one of our customers. As part of the requirement, we generated a new encryption key using the addKey command in the iiq keystore console. iiq.dat and iiq.cfg files were created successfully in WEB-INF/classes, but when we tried running the “Encrypted Data Synchronization” task, it was failing with the below error.
“An unexpected error occurred: the final block was not properly padded. Such issues can arise if a bad key is used during decryption.”

We tried rerunning the addKey command, assuming there might be an issue with the key generated, but no luck. Could you please help us on this?

Some additional findings: the task is running successfully if the “Disable App Sync Check box is checked,” and I can see the task is failing exactly when it starts updating one of the Active Directory Application object.

Thanks in Advance !!

Regards,
Lohith.Y

Hi Lolith,
Do you have multi-note cluster? did you copy iiq.dat and iiq.cfg to other nodes as well?
Do you have cloud gateweay? did you sync keys with it?
Did you sync keys to iqService? following this manual
https://community.sailpoint.com/t5/IdentityIQ-Forum/IQService-Host-Encryption-Key-Synchronization/m-p/67009

1 Like

This error will come if value is not in clear text or not encrypted with default key or not encrypted with key available in current env . to me seems like you have password in your env which was encrypted by the key which is not available in this env.

1 Like

Hello vishal,

When I ran the list command in the iiq keystore, I could see all the keys (1 and 2) present, and we’re facing this issue specifically for application objects. If I exclude app objects, the task is running successfully.

I think any of the application secrets are encrypted using the key which doesn’t exist in system , may be that encrypted secret would have come from lower env .

Or else what you can do is update all the pwd with default key and then you can sync with latest key uisng this job.

1 Like

If you know passwords you may just try to reenter them in the gui an copy new hashes to ssb.

1 Like

Hello @kjakubiak and @vishal_kejriwal1 ,

Is there any way to delete the existing keys and revert the encryption key back to the default.

Hi Lolith,
I’m affraid you are not able to just remove keys from the store - the only way is to remove the store and create new one with new encryption keys.

If you want to move back to default encryption keys than it’s enought if you remove the iiq.dat file but remember that passwords encrypted with old keys won’t work properly anymore.

Here you can find a bit more about keys and encryption
https://documentation.sailpoint.com/identityiq/help/systemconfig/using__keystore.html?Highlight=site

To resolve this issue, I ran a script that listed all applications with passwords encrypted using the old key. During decryption, I discovered an application encountering the same error. I didn’t import any external passwords for this app, so I’m uncertain why this occurred. To fix it, I got the password in plaintext and added it to the application’s UI, which successfully resolved the issue.

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.