This website uses cookies. By clicking Accept, you consent to the use of cookies. Click Here to learn more about how we use cookies.
Accept
Reject
Register Now
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 

SecurID® Governance & Lifecycle Knowledge Base

Find answers to your questions and identify resolutions for known issues with knowledge base articles written by SecurID Governance & Lifecycle experts.

"Error Handling KEK" when accessing the RSA Identity Governance and Lifecycle portal after upgrading to 7.0.1 in a WebSphere environment

Article Number

000034738

Applies To

RSA Product Set: RSA Identity Governance and Lifecycle
RSA Version/Condition: 7.0.1
Platform: WebSphere 8.5
 

Issue

After completing an upgrade from 6.8.1 to 7.0.1 in a software only - WebSphere environment, the following Initialization Status messages appears when accessing the RSA Identity Governance and Lifecycle portal.


Image descriptionImage description

The aveksaServer.log located in /home/oracle/IBM/WebSphere/AppServer/profiles/AppSrv01/installedApps/<nodename>/aveksa.ear/aveksa.war/log contains the following stack traces:

01/24/2017 14:35:34.088 ERROR (server.startup : 1) [com.aveksa.server.core.crypto.EncryptionServiceProvider] Error handling KEK
  
com.aveksa.server.runtime.ServerException: Unable to generate default encryption key entry
	at com.aveksa.server.core.crypto.EncryptionServiceProvider.createEncryptionKey(EncryptionServiceProvider.java:593)
	at com.aveksa.server.core.crypto.EncryptionServiceProvider.createDefaultKek(EncryptionServiceProvider.java:204)
	at com.aveksa.server.core.crypto.EncryptionServiceProvider.getOrCreateDefaultKek(EncryptionServiceProvider.java:176)
	at com.aveksa.server.core.crypto.EncryptionServiceProvider.setupEncryptors(EncryptionServiceProvider.java:103)
	at com.aveksa.server.core.crypto.EncryptionServiceProvider.initialize(EncryptionServiceProvider.java:86)
	at com.aveksa.server.core.Container.registerService(Container.java:289)
	at com.aveksa.server.core.Container.initialize(Container.java:83)
	at com.aveksa.server.runtime.AveksaSystem.doStartupOperations(AveksaSystem.java:329)
	at com.aveksa.server.runtime.AveksaSystem.initialize(AveksaSystem.java:305)
	at com.aveksa.init.Startup.init(Startup.java:52)
	at com.aveksa.gui.core.ACMFramework.init(ACMFramework.java:94)
	at com.aveksa.gui.core.ACMFramework.initInstance(ACMFramework.java:83)
	at com.aveksa.init.InitServlet.init(InitServlet.java:42)
	at com.ibm.ws.webcontainer.servlet.ServletWrapper.init(ServletWrapper.java:344)
	at com.ibm.ws.webcontainer.servlet.ServletWrapperImpl.init(ServletWrapperImpl.java:168)
	at com.ibm.ws.webcontainer.servlet.ServletWrapper.loadOnStartupCheck(ServletWrapper.java:1368)
	at com.ibm.ws.webcontainer.webapp.WebApp.doLoadOnStartupActions(WebApp.java:629)
	at com.ibm.ws.webcontainer.webapp.WebApp.commonInitializationFinally(WebApp.java:595)
	at com.ibm.ws.webcontainer.webapp.WebAppImpl.initialize(WebAppImpl.java:422)
	at com.ibm.ws.webcontainer.webapp.WebGroupImpl.addWebApplication(WebGroupImpl.java:88)
	at com.ibm.ws.webcontainer.VirtualHostImpl.addWebApplication(VirtualHostImpl.java:170)
	at com.ibm.ws.webcontainer.WSWebContainer.addWebApp(WSWebContainer.java:904)
	at com.ibm.ws.webcontainer.WSWebContainer.addWebApplication(WSWebContainer.java:789)
	at com.ibm.ws.webcontainer.component.WebContainerImpl.install(WebContainerImpl.java:427)
	at com.ibm.ws.webcontainer.component.WebContainerImpl.start(WebContainerImpl.java:719)
	at com.ibm.ws.runtime.component.ApplicationMgrImpl.start(ApplicationMgrImpl.java:1177)
	at com.ibm.ws.runtime.component.DeployedApplicationImpl.fireDeployedObjectStart(DeployedApplicationImpl.java:1382)
	at com.ibm.ws.runtime.component.DeployedModuleImpl.start(DeployedModuleImpl.java:639)
	at com.ibm.ws.runtime.component.DeployedApplicationImpl.start(DeployedApplicationImpl.java:971)
	at com.ibm.ws.runtime.component.ApplicationMgrImpl.startApplication(ApplicationMgrImpl.java:776)
	at com.ibm.ws.runtime.component.ApplicationMgrImpl$5.run(ApplicationMgrImpl.java:2195)
	at com.ibm.ws.security.auth.ContextManagerImpl.runAs(ContextManagerImpl.java:5477)
	at com.ibm.ws.security.auth.ContextManagerImpl.runAsSystem(ContextManagerImpl.java:5603)
	at com.ibm.ws.security.core.SecurityContext.runAsSystem(SecurityContext.java:255)
	at com.ibm.ws.runtime.component.ApplicationMgrImpl.start(ApplicationMgrImpl.java:2200)
	at com.ibm.ws.runtime.component.CompositionUnitMgrImpl.start(CompositionUnitMgrImpl.java:435)
	at com.ibm.ws.runtime.component.CompositionUnitImpl.start(CompositionUnitImpl.java:123)
	at com.ibm.ws.runtime.component.CompositionUnitMgrImpl.start(CompositionUnitMgrImpl.java:378)
	at com.ibm.ws.runtime.component.CompositionUnitMgrImpl.access$500(CompositionUnitMgrImpl.java:126)
	at com.ibm.ws.runtime.component.CompositionUnitMgrImpl$CUInitializer.run(CompositionUnitMgrImpl.java:984)
	at com.ibm.wsspi.runtime.component.WsComponentImpl$_AsynchInitializer.run(WsComponentImpl.java:502)
	at com.ibm.ws.util.ThreadPool$Worker.run(ThreadPool.java:1881)
Caused by: 
com.aveksa.common.crypto.EncryptionException: An issue with handling encryption was encountered
	at com.aveksa.common.crypto.EncryptionMgr.getSecureRandom(EncryptionMgr.java:708)
	at com.aveksa.common.crypto.EncryptionMgr.generateRandomString(EncryptionMgr.java:1113)
	at com.aveksa.common.crypto.EncryptionMgr.generateUniqueKeyValue(EncryptionMgr.java:1162)
	at com.aveksa.common.crypto.EncryptionMgr.generateUniqueKeyValue(EncryptionMgr.java:1134)
	at com.aveksa.server.core.crypto.EncryptionServiceProvider.generateKeyValue(EncryptionServiceProvider.java:983)
	at com.aveksa.server.core.crypto.EncryptionServiceProvider.generateNewEncryptionKeyEntry(EncryptionServiceProvider.java:853)
	at com.aveksa.server.core.crypto.EncryptionServiceProvider.createEncryptionKey(EncryptionServiceProvider.java:588)
	... 41 more
Caused by: 
com.aveksa.common.crypto.EncryptionException: Non-FIPS140 Crypto-J toolkit in classpath.
	at com.aveksa.common.crypto.EncryptionMgr.addProvider(EncryptionMgr.java:754)
	at com.aveksa.common.crypto.EncryptionMgr.getSecureRandom(EncryptionMgr.java:706)
	... 47 more
01/24/2017 14:35:34.096 ERROR (server.startup : 1) [com.aveksa.server.core.Container] Unable to register service EncryptionService. 
com.aveksa.server.runtime.ServerException: Unable to generate default encryption key entry
	at com.aveksa.server.core.crypto.EncryptionServiceProvider.getOrCreateDefaultEncryptionKey(EncryptionServiceProvider.java:550)
	at com.aveksa.server.core.crypto.EncryptionServiceProvider.setupDefaultEncryptor(EncryptionServiceProvider.java:127)
	at com.aveksa.server.core.crypto.EncryptionServiceProvider.setupEncryptors(EncryptionServiceProvider.java:112)
	at com.aveksa.server.core.crypto.EncryptionServiceProvider.initialize(EncryptionServiceProvider.java:86)
	at com.aveksa.server.core.Container.registerService(Container.java:289)
	at com.aveksa.server.core.Container.initialize(Container.java:83)
	at com.aveksa.server.runtime.AveksaSystem.doStartupOperations(AveksaSystem.java:329)
	at com.aveksa.server.runtime.AveksaSystem.initialize(AveksaSystem.java:305)
	at com.aveksa.init.Startup.init(Startup.java:52)
	at com.aveksa.gui.core.ACMFramework.init(ACMFramework.java:94)
	at com.aveksa.gui.core.ACMFramework.initInstance(ACMFramework.java:83)
	at com.aveksa.init.InitServlet.init(InitServlet.java:42)
	at com.ibm.ws.webcontainer.servlet.ServletWrapper.init(ServletWrapper.java:344)
	at com.ibm.ws.webcontainer.servlet.ServletWrapperImpl.init(ServletWrapperImpl.java:168)
	at com.ibm.ws.webcontainer.servlet.ServletWrapper.loadOnStartupCheck(ServletWrapper.java:1368)
	at com.ibm.ws.webcontainer.webapp.WebApp.doLoadOnStartupActions(WebApp.java:629)
	at com.ibm.ws.webcontainer.webapp.WebApp.commonInitializationFinally(WebApp.java:595)
	at com.ibm.ws.webcontainer.webapp.WebAppImpl.initialize(WebAppImpl.java:422)
	at com.ibm.ws.webcontainer.webapp.WebGroupImpl.addWebApplication(WebGroupImpl.java:88)
	at com.ibm.ws.webcontainer.VirtualHostImpl.addWebApplication(VirtualHostImpl.java:170)
	at com.ibm.ws.webcontainer.WSWebContainer.addWebApp(WSWebContainer.java:904)
	at com.ibm.ws.webcontainer.WSWebContainer.addWebApplication(WSWebContainer.java:789)
	at com.ibm.ws.webcontainer.component.WebContainerImpl.install(WebContainerImpl.java:427)
	at com.ibm.ws.webcontainer.component.WebContainerImpl.start(WebContainerImpl.java:719)
	at com.ibm.ws.runtime.component.ApplicationMgrImpl.start(ApplicationMgrImpl.java:1177)
	at com.ibm.ws.runtime.component.DeployedApplicationImpl.fireDeployedObjectStart(DeployedApplicationImpl.java:1382)
	at com.ibm.ws.runtime.component.DeployedModuleImpl.start(DeployedModuleImpl.java:639)
	at com.ibm.ws.runtime.component.DeployedApplicationImpl.start(DeployedApplicationImpl.java:971)
	at com.ibm.ws.runtime.component.ApplicationMgrImpl.startApplication(ApplicationMgrImpl.java:776)
	at com.ibm.ws.runtime.component.ApplicationMgrImpl$5.run(ApplicationMgrImpl.java:2195)
	at com.ibm.ws.security.auth.ContextManagerImpl.runAs(ContextManagerImpl.java:5477)
	at com.ibm.ws.security.auth.ContextManagerImpl.runAsSystem(ContextManagerImpl.java:5603)
	at com.ibm.ws.security.core.SecurityContext.runAsSystem(SecurityContext.java:255)
	at com.ibm.ws.runtime.component.ApplicationMgrImpl.start(ApplicationMgrImpl.java:2200)
	at com.ibm.ws.runtime.component.CompositionUnitMgrImpl.start(CompositionUnitMgrImpl.java:435)
	at com.ibm.ws.runtime.component.CompositionUnitImpl.start(CompositionUnitImpl.java:123)
	at com.ibm.ws.runtime.component.CompositionUnitMgrImpl.start(CompositionUnitMgrImpl.java:378)
	at com.ibm.ws.runtime.component.CompositionUnitMgrImpl.access$500(CompositionUnitMgrImpl.java:126)
	at com.ibm.ws.runtime.component.CompositionUnitMgrImpl$CUInitializer.run(CompositionUnitMgrImpl.java:984)
	at com.ibm.wsspi.runtime.component.WsComponentImpl$_AsynchInitializer.run(WsComponentImpl.java:502)
	at com.ibm.ws.util.ThreadPool$Worker.run(ThreadPool.java:1881)
Caused by: 
com.aveksa.server.runtime.ServerException: Unable to generate default encryption key entry
	at com.aveksa.server.core.crypto.EncryptionServiceProvider.createEncryptionKey(EncryptionServiceProvider.java:593)
	at com.aveksa.server.core.crypto.EncryptionServiceProvider.getOrCreateDefaultEncryptionKey(EncryptionServiceProvider.java:509)
	... 40 more
Caused by: 
com.aveksa.common.crypto.EncryptionException: An issue with handling encryption was encountered
	at com.aveksa.common.crypto.EncryptionMgr.getSecureRandom(EncryptionMgr.java:708)
	at com.aveksa.common.crypto.EncryptionMgr.generateRandomString(EncryptionMgr.java:1113)
	at com.aveksa.common.crypto.EncryptionMgr.generateUniqueKeyValue(EncryptionMgr.java:1162)
	at com.aveksa.common.crypto.EncryptionMgr.generateUniqueKeyValue(EncryptionMgr.java:1134)
	at com.aveksa.server.core.crypto.EncryptionServiceProvider.generateKeyValue(EncryptionServiceProvider.java:983)
	at com.aveksa.server.core.crypto.EncryptionServiceProvider.generateNewEncryptionKeyEntry(EncryptionServiceProvider.java:853)
	at com.aveksa.server.core.crypto.EncryptionServiceProvider.createEncryptionKey(EncryptionServiceProvider.java:588)
	... 41 more
Caused by: 
com.aveksa.common.crypto.EncryptionException: Non-FIPS140 Crypto-J toolkit in classpath.
	at com.aveksa.common.crypto.EncryptionMgr.addProvider(EncryptionMgr.java:754)
	at com.aveksa.common.crypto.EncryptionMgr.getSecureRandom(EncryptionMgr.java:706)
	... 47 more


 

Cause

There are BSAFE or Crypto libraries that are conflicting with the RSA Identity Governance and Lifecycle code. The FIPS (Federal Information Processing Standard) compliance is managed by the RSA Identity Governance and Lifecycle application. Hence, the presence of any BSAFE or Crypto libraries outside of the RSA Identity Governance and Lifecycle application conflicts with the RSA Identity Governance and Lifecycle code and does not allow for the enablement of FIPS compliance.

 

Resolution

  1. Access the WebSphere console and select Troubleshooting > Class Loader viewer > <server_name> > Applications > aveksa > Web modules > aveksa.war.
Image descriptionImage description
  1. Click Table View and see if any of the .jar files listed below are picked from the classpath outside the aveksa.ear located in /opt/IBM/Websphere/Profiles/<Profile_Name>/installedApps/<cell_name>/aveksa.ear/*. If so, remove the .jar file from the classpath location
  • cryptojce.jar
  • cryptoj.jar
  • cryptojcommon.jar
  • jcmFIPS.jar
  • util .jar
For example, in this case cryptoj.jar was picked from the parent WebSphere installation folder:
 
Image descriptionImage description
  1. Remove the conflicting jar files found above.
  2. Restart the WebSphere Application Server and then the RSA Identity Governance and Lifecycle application.

 
0 Likes
Was this article helpful? Yes No
No ratings

In this article

Version history
Last update:
‎2020-12-13 12:09 AM
Updated by:
Administrator Administrator

Related Content

© 2023 RSA Security LLC or its affiliates. All rights reserved.