Versions Compared


  • This line was added.
  • This line was removed.
  • Formatting was changed.


An initial key is generated by the installer in a special kind of Java keystore file called a "JCEKS" keystore, which stores secret keys instead of public/private keys and certificates. A parallel file also tracks the key version number. A tool is provided to regularly update this secret key (and increase the version), which can be pushed to cluster nodes and continually maintain the secrecy of this key. This should be done at least daily to limit the chance for, and damage from, exposure. You can list the keys with the Java keytool utility (change the <secret> accordingly):


command to list keys
Code Block
keytool -v -list -keystore sealer.jks -storepass <secret> -storetype JCEKS


To roll the key, a script similar to the following can be used in a scheduled task on one of the cluster nodes or a staging server:



bash example to update and copy secret key
Code Block


$IDP_HOME/bin/ \
	--storefile $IDP_HOME/credentials/sealer.jks \
	--storepass password \
	--versionfile $IDP_HOME/credentials/sealer.kver \
	--alias secret 

scp $IDP_HOME/credentials/sealer.* host1:$IDP_HOME/credentials/
scp $IDP_HOME/credentials/sealer.* host2:$IDP_HOME/credentials/


It adds some new properties - so that all features are completely configurable from the (prefixed with _ as they are unofficial)

  • idp.sealer._count

    • Number of earlier keys to keep (default 30)

  • idp.sealer._sync_hosts

    • Space separated list of hosts to scp the sealer files to (default generate locally)




example using the configuration from or
Code Block

set -e 
set -u
# Default IDP_HOME if not already set
if [ ! -d "${IDP_HOME:=/opt/shibboleth-idp}" ]
    echo "ERROR: Directory does not exist: ${IDP_HOME}" >&2
    exit 1

function get_config {
    # Key to lookup (escape . for regex lookup)
    local KEY=${1:?"No key provided to look up value"}
    # Passed default value
    local DEFAULT="${2:-}"
    # Lookup key, strip spaces, replace idp.home with IDP_HOME value
    local RESULT=$(sed -rn '/^'"${KEY//./\\.}"'\s*=/ { s|^[^=]*=(.*)\s*$|\1|; s|%\{idp\.home\}|'"${IDP_HOME}"'|g; p}' ${IDP_HOME}/conf/
    if [ -z "$RESULT" ]
       local RESULT=$(sed -rn '/^'"${KEY//./\\.}"'\s*=/ { s|^[^=]*=(.*)\s*$|\1|; s|%\{idp\.home\}|'"${IDP_HOME}"'|g; p}' ${IDP_HOME}/credentials/
    # Set if no result with default - exit if no default
    echo ${RESULT:-${DEFAULT:?"No value in config and no default defined for: '${KEY}'"}}

# Get config values
## Official config items ##
storefile=$(get_config idp.sealer.storeResource)
versionfile=$(get_config idp.sealer.versionResource)
storepass=$(get_config idp.sealer.storePassword)
alias=$(get_config idp.sealer.aliasBase secret)
## Extended config items ##
count=$(get_config idp.sealer._count 30)
# default cannot be empty - so "self" is the default (self is skipped for syncing)
sync_hosts=$(get_config idp.sealer._sync_hosts ${HOSTNAME})

# Run the keygen utility 
${0%/*}/ \
    --storefile "${storefile}" \
    --storepass "${storepass}" \
    --versionfile "${versionfile}" \
    --alias "${alias}" \
    --count "${count}"

# Display current version
echo "INFO: $(tac "${versionfile}" | tr "\n" " ")" >&2

for EACH in ${sync_hosts}
    if [ "${HOSTNAME}" == "${EACH}" ]
        echo "INFO: Host '${EACH}' is myself - skipping" >&2
    elif ! ping -q -c 1 -W 3 ${EACH} >/dev/null 2>&1
        echo "ERROR: Host '${EACH}' not reachable - skipping" >&2
		# run scp in the background 
        scp "${storefile}" "${versionfile}" "${EACH}:${IDP_HOME}/credentials/" &