Page History

...

• Encrypted values start with the prefix enc://.
• The value holds the following parts separated by spaces:
  • an the encrypted symmetric key,
  • an the initialization vector,
  • the secret encrypted with the symmetric key.
• For decryption a private key Private Key and the initialization vector are used to decrypt the symmetric key. The secret is decrypted using the decrypted, symmetric key.

...

• The js7_encrypt.sh | .cmd script is called with the --cert argument that specifies the path to the Certificate file or Public Key file. The --in argument specifies the plain text password.
• Consider that the Certificate/Public Key used for encryption has to match the Private Key used by the component that performs decryption:
  • for JOC Cockpit the Private Key is located in the JOC Cockpit data directory.
  • for JS7 JITL Jobs that are executed with an Agent the Private Key is located with the related Agent.
• For use with Unix
  • the script writes output to the stdout channel that is assigned an environment variable.
  • the sed command is used to replace the related element value in the hibernate.cfg.xml configuration file.
• For use with Windows
  • the script writes output to the JS7_ENCRYPT_VALUE environment variable.
  • the powershell.exe command is used to replace the related element value in the hibernate.cfg.xml configuration file.

Integration with Password Manager Products

The scripts can be integrated with Password Manager products that are used to create and to rotate passwords. A number of Password Manager products offer hooks that allow to call scripts after a password is changed which is the preferred integration scenario.

• The JOC Cockpit and JITL Jobs will pick up a changed Hibernate configuration file on-the-fly for the next database connection that will be created.
• Current database connections are not affected. When connections are refreshed in the JOC Cockpit connection pool, they will make use of the updated Hibernate configuration file.

Decryption

The Hibernate configuration file has to hold a reference where to locate the Private Key used for decryption:

...

The path to the Private Key file is specified from a property in the hibernate.cfg.xml file. The Private Key can optionally be protected by a password. The password is not a secret but aims to check integrity when reading/writing private keys. If no password is used to access the Private Key, then the related property should not be specified.

Related properties in the hibernate.cfg.xml file look like thisinclude:

  <property name="hibernate.connection.password">enc://gLjIPeUJP3o1cw4y9wNrFkNUIfe5Bi/eW+KMkLUy4mvVOH0Z41V0Iuob0lDN6UFXMG1//YDbUA3yFSpvHdmRlGnYsMPkbqz+tN+7Ypy5px7F7NGGpPFSeeGS4JOe7cmgkHx9i9ZPJEEK/xDLoPj/9zj4OLTcWxrHKR0bwT2NvpEZoBPWVnWMoBqTQfk+PBRRkQFYdtR+uKVl7qMEkNc6N92hYGRevUwIZ7h++ENazlgzUdNZc1K1LCRZ/BtB8/MopP3elZ6Vq2LmP3LGnzu6MwSSBgNbPN2vguDqWjnncO1h5MekmqHV5S9RY2L+7NZ7jJ3q233ZFwq56Xm/TWB92g== U2WnoXgh87kdOz7Zcumkpg== 3mnbt2Qe7JdQuN2Lm5SD0w==</property>
  <property name="hibernate.connection.url">enc://oe5qm3SOudO8LgcFXlW3cTlsdLycXEgUis2GFJdm+4w/NHF3KGYZXCEsqUFMwvWsdY/whfkCPOyUf4cj1eY1F5QSVzjsCgpfXtpvqUjqa7mzpAfzHfRr8gjZNHzCinefke8muCYFiZbb8s9rWHu4G8aIAJsxlWrhJeu7SXqs3JPrrrBt9EJ8kJw6w/xWbUhR5MVLAvj9mIg+w83qwAhZrvuz+McoTKskXvLcBlQPtXc+Yz3RuosczmaWgHYcc/++CtnHHtlSVQf9108jus13ab6mGGsDjodVJjm715VB+cUmWhBKpwyjksrISKcpkMnGlSK3KE+VsTMjzAMPPAyGEQ== zzEKadcxLgfl4GrRUYvApA== FM5ycloUYUbUeniZUDZpK7atxQR5bvmJmYJLS1k356oA/fCoioE6zFfOzENTKgxn</property>
  <property name="hibernate.connection.username">enc://WCWDGolHrQV4zWwF7i+QEOMrzXfhQSWoH4Azb+udCPSXsvDcNBiTam9zSVDyzCkVT3VAoBdT+WQbOSJRtdvYv6IaIJHJ98W5+H/F29UlOtKhJFbzVq+qxT4XPHSlMvzhub72lv5sWEyhNsjdFd6tJj0mVVH7+jmMAzFMCMKfMeNUbsXrH5Os6UR0Uqy6KbjVx8BOv02ooqFb69yFyI76/gwkxAV+9fYinCxIj3adSO1P6Cn0VNXLw1y2z/Xuv2PJ9CusshmMEiG95/G85VSNqlSMV0HfiQ71VS2EN0fcVcFlugyslTUDIcP4ed3pNlwblu86oPoenC4Xvw3Qh2Xj/A== IcI4xRV0fnO+qRLLg3/abQ== 1gV4bt2rvMgdtPOPXFt5qw==</property>

  <property name="hibernate.sos.decryption_key">joc.key</property>
  <property name="hibernate.sos.decryption_keypassword">jobscheduler</property>

...

The path to the keystore file is specified from a property in the hibernate.cfg.xml file. The keystore should be in comply to PKCS12 format.

Related properties in the hibernate.cfg.xml file look like thisinclude:

  <property name="hibernate.connection.password">enc://gLjIPeUJP3o1cw4y9wNrFkNUIfe5Bi/eW+KMkLUy4mvVOH0Z41V0Iuob0lDN6UFXMG1//YDbUA3yFSpvHdmRlGnYsMPkbqz+tN+7Ypy5px7F7NGGpPFSeeGS4JOe7cmgkHx9i9ZPJEEK/xDLoPj/9zj4OLTcWxrHKR0bwT2NvpEZoBPWVnWMoBqTQfk+PBRRkQFYdtR+uKVl7qMEkNc6N92hYGRevUwIZ7h++ENazlgzUdNZc1K1LCRZ/BtB8/MopP3elZ6Vq2LmP3LGnzu6MwSSBgNbPN2vguDqWjnncO1h5MekmqHV5S9RY2L+7NZ7jJ3q233ZFwq56Xm/TWB92g== U2WnoXgh87kdOz7Zcumkpg== 3mnbt2Qe7JdQuN2Lm5SD0w==</property>
  <property name="hibernate.connection.url">enc://oe5qm3SOudO8LgcFXlW3cTlsdLycXEgUis2GFJdm+4w/NHF3KGYZXCEsqUFMwvWsdY/whfkCPOyUf4cj1eY1F5QSVzjsCgpfXtpvqUjqa7mzpAfzHfRr8gjZNHzCinefke8muCYFiZbb8s9rWHu4G8aIAJsxlWrhJeu7SXqs3JPrrrBt9EJ8kJw6w/xWbUhR5MVLAvj9mIg+w83qwAhZrvuz+McoTKskXvLcBlQPtXc+Yz3RuosczmaWgHYcc/++CtnHHtlSVQf9108jus13ab6mGGsDjodVJjm715VB+cUmWhBKpwyjksrISKcpkMnGlSK3KE+VsTMjzAMPPAyGEQ== zzEKadcxLgfl4GrRUYvApA== FM5ycloUYUbUeniZUDZpK7atxQR5bvmJmYJLS1k356oA/fCoioE6zFfOzENTKgxn</property>
  <property name="hibernate.connection.username">enc://WCWDGolHrQV4zWwF7i+QEOMrzXfhQSWoH4Azb+udCPSXsvDcNBiTam9zSVDyzCkVT3VAoBdT+WQbOSJRtdvYv6IaIJHJ98W5+H/F29UlOtKhJFbzVq+qxT4XPHSlMvzhub72lv5sWEyhNsjdFd6tJj0mVVH7+jmMAzFMCMKfMeNUbsXrH5Os6UR0Uqy6KbjVx8BOv02ooqFb69yFyI76/gwkxAV+9fYinCxIj3adSO1P6Cn0VNXLw1y2z/Xuv2PJ9CusshmMEiG95/G85VSNqlSMV0HfiQ71VS2EN0fcVcFlugyslTUDIcP4ed3pNlwblu86oPoenC4Xvw3Qh2Xj/A== IcI4xRV0fnO+qRLLg3/abQ== 1gV4bt2rvMgdtPOPXFt5qw==</property>

  <property name="hibernate.sos.keystore_path">credentials-keystore.p12</property>
  <property name="hibernate.sos.keystore_type">PKCS12</property>
  <property name="hibernate.sos.keystore_password">jobscheduler</property>
  <property name="hibernate.sos.keystore_keypassword">jobscheduler</property>
  <property name="hibernate.sos.keystore_keyalias">joc-2-0-primary</property>

Explanation:

• hibernate.sos.keystore_path: The keystore path can be specified as from an absolute path or from a relative path. The relative path starts from the JETTY_BASE/resources/joc directory of the JOC Cockpit installation.
• hibernate.sos.keystore_type: The PKCS12 keystore type should be used. Typically keystores with the file name extension .p12 or .pfx signal a PKCS12 compliant keystore.

• hibernate.sos.keystore_password: The keystore should be be protected by a password. The password is not a secret, but aims to check integrity when reading/writing keystores.

• hibernate.sos.keystore_keypassword: For use with the PKCS12 format the password for the key and the password for the keystore have to match.

• hibernate.sos.keystore_keyalias: The Private Key's alias name is a unique identifier of the key in the keystore. An alias name has to be specified if more than one Private Key is available in the keystore. The property can be omitted for keystores that hold a single key.

Use with JOC Cockpit HTTPS Keystore

...