Using ABS command line interface, you can obfuscate the keys and passwords configured in The keys and passwords obfuscated include:

  • mongo_password
  • jks_password
  • email_password

ABS ships with a default abs_master.key which is used to obfuscate the keys and passwords. It is recommended to generate your own abs_master.key.

Note: During the process of obfuscation of keys and password, ABS must be stopped .

The following diagram summarizes the obfuscation process: Diagram showing the flow of obfuscation process

Generate abs_master.key

You can generate the abs_master.key by running the generate_obfkey ABS CLI command.

/opt/pingidentity/abs/bin/ generate_obfkey -u admin -p admin
Please take a backup of config/abs_master.key before proceeding.
Warning: Once you create a new obfuscation master key, you should obfuscate all config keys also using -obfuscate_keys
Warning: Obfuscation master key file
/pingidentity/abs/config/abs_master.key already exists. This command will delete it and create a new key in the same file
Do you want to proceed [y/n]: y
Creating new obfuscation master key
Success: created new obfuscation master key at /pingidentity/abs/config/abs_master.key

The new abs_master.key is used to obfuscate the passwords in file.

Important: After the keys and passwords are obfuscated, the abs_master.key must be moved to a secure location and not stored on ABS.

In an ABS cluster, the abs_master.key must be manually copied to each of the cluster nodes.

Obfuscate key and passwords

Enter the keys and passwords in clear text in the file. Run the obfuscate_keys command to obfuscate keys and passwords:

/opt/pingidentity/abs/bin/ obfuscate_keys -u admin -p admin
Please take a backup of config/abs.password before proceeding
Enter clear text keys and passwords before obfuscation.
Following keys will be obfuscated
config/ mongo_password, jks_password and email_password
Do you want to proceed [y/n]: y
obfuscating /pingidentity/abs/config/
Success: secret keys in /pingidentity/abs/config/ obfuscated

Start ABS after passwords are obfuscated.