How to update passwords in ism-configuration.properties

[skoehler]

Hi all,

I want to handle password changes (like keystores and technical users) by a script, so I need to update the passwords stored at ism-configuration.properties.

I haven’t found any documentation about calling configupdate.sh with command line parameters (like ndsconfig set we all know about) to configure the options I intend, so I assume I have to modify ism-configuration.properties itself.

That brings up a few questsions:

I find parameters ending at .pwd._attr_obscurity with a value of ENCRYPT. Is there any documentation about that, does it support any other values and what does ENCRYPT stand for (well obviously encryption, but which kind of, how could I encrypt a new password myself to replace the string). The corresponding parameter “.pwd” looks like 3 base64-encoded components separated by :, but doing a decode of each of these components didn’t give me anything that reminds me to my passwords set.

Can I modify each of the parameters and trigger a restart of tomcat to make things work the way I’d like or is there some more magic behind configupdate.sh (like updating other conf-files)

Steffen

[geoffc · Accepted solution]

This is actually in the docs! 

https://www.netiq.com/documentation/identity-manager-48/setup_linux/data/b17xtt5c.html

You can change the password of a property, for example com.netiq.rpt.ssl-keystore from the command line by performing the following steps:

    Use the below utility to encrypt your password:

    /opt/netiq/common/jre/bin/java -jar tomcat/lib/obscurity-0.7.0-uber.jar <<Password>>

    Navigate to the ism-configuration.properties file located at /opt/netiq/idm/apps/tomcat/conf/ directory.

    Modify the ism-configuration.properties file and add the encrypted password specified in step 2 for the com.netiq.rpt.ssl-keystore.pwd parameter.

    Save the file and restart Tomcat.

So you need to call the obscurity JAR to encrypt the password, then you can update the values in the file via your script.

[skoehler]

Thanks a lot, missed that one!

[geoffc]

The server.xml <Connections> uses this encryption method as well if you need to script the DB passwords into it.

And there is one more type of encrypted password.... 

The OSP file for bootstrap admin, uses a different method, also in the docs (Basically a different Java class) which I forget the link and am now too lazy to find for you.  So if you want different bootstrap admin (More of an IDG than IDM thing) then you need that file).

[skoehler]

got it...

yeah, all relevant info in 1 place - that's still a dream of mine...