Unity Console Admin Guide

In this mode, the Master Key is generated using a software crypto provider and split according to M of N rule. It is a good practice to renew the master key after regular intervals in order to ensure security. To renew the master key, follow the instructions below: 

Pre-requisites

There are some pre-requisites that must be taken care of before renewing the master list. These include: 

• Take the backup of database and <ADSS-INSTALLATION-DIR>\conf\adss_startup.properties.
• If other instances are running in load balance mode, make sure all instances are alive and connected so that required information can be synchronized with other instances after renewal of master key.
• Increase console session timeout to 15 or more minutes by going to Global Settings > Miscellaneous.

Once pre-requisites are satisfied, we can carry on with our configurations. To renew the master key navigate to ADSS Console > Global Settings > System Security > Master Key Settings section. It will display the following screen:

In the above screen, the Master Key Type can be seen and if the user wants to receive alerts upon renewal or backup of master key, it is recommended to enable the alerts by marking the respective checkbox. Clicking on Renew Master Key button will lead you to the screen below:

Here, all the options will be displayed and the current option will appear as selected. The key can be renewed by using the same option or the user can switch to another option. Here the user can also define a new M of N scheme for the new key. The 'Software based key with M on N controls - Manual Startup' can be switched to 'Hardware based key - Manual Startup' only and cannot go back to the previous option i.e. 'Software based key - Auto Startup'. Below is the detail of the allowed and not-allowed options:

• Software based key with M of N controls - Hardware based key - Manual Startup (allowed))
• Software based key with M of N controls - Software based key - Auto Startup (not allowed)

If the user has switched to another option, it will have to provide the relevant information in the respective fields. Clicking on the Next button will lead to the following screen:

At this stage, the Master Key has been generated, now the backup of the generated master key needs to be taken. Since the key is split into N parts, the N number of users will be required to take backup of each component. Clicking on the backup button will lead you to the following screen:

Click on the OK button to download the newly generated key to the file system. On completion, the following screen will be shown confirming the backup of all the components with success message: 

Clicking on the Next button will display the following screen:

Upon the renewal of master key, the required information has to be synchronized with other instances as well. The above screen shows the progress of synchronization of instances running in load balance mode. As soon as an instance is synchronized, a tick mark appears in the status column against that instance.   

If the synchronization of information with any instance is failed, a cross will appear in the status column against that instance. The user can retry to synchronize with failed instance by clicking on Retry button. An example of the failed instance is shown in the image below: 

In order to know the reason of failure, the user can check the <ADSS-INSTALLATION-DIR>\log\console\console.log file of ADSS Server and also the debug logs of that particular instance for which the failure has occurred. The issue can be resolved after knowing the reason of failure and taking appropriate steps for its resolution, but in case if the issue still presides and the user wants to conclude the renewal process, it can simply click on the Finish button. In this case the master key will be renewed but the local information will not be synchronized with the failed instance and they will appear on the System Security screen as a pending instance as shown in the screen below: 

Here also, the user has an option to retry by clicking on Retry button. In a case where instance is not recovered even by trying again and again and is no longer required, then it can be deleted by navigating to ADSS Console > Server Manager. Restart all the instances i.e. Core, Console and Service in order for changes to take effect.

See also

Software Based Key - Auto Startup
Hardware Based Key - Manual Startup