Change the JWT Signing Key

Search for	Example	Results
A single word	`cat`	Topics that contain the word "cat". You will also find its grammatical variations, such as "cats".
A phrase. You can specify that the search results contain a specific phrase.	`"cat food"` (quotation marks)	Topics that contain the literal phrase "cat food" and all its grammatical variations. Without the quotation marks, the query is equivalent to specifying an OR operator, which finds topics with one of the individual words instead of the phrase.

Search for	Operator	Example
Two or more words in the same topic	`AND` `and` `+` (plus symbol) `&` (ampersand)	`cat AND dog` `"cat food"+milk` `"cat food"&"dog food"`
Either word in a topic	`OR` `or` `\|` (pipe)	`cat OR dog` `cat \| dog`
Topics that do not contain a specific word or phrase	`NOT` `not` `!` (exclamation point)	`NOT cat` `! dog`
Topics that contain one string and do not contain another	`^` (caret)	`cat ^ mouse`
A combination of search types	`( )` parentheses	`cat + (dog \| mouse)` `cat \| dog + (! mouse)`

Important: After changing the password for the idmTransportUser, you should also change the JWT signing key. To accomplish this, you must update all of the following four properties with identical encrypted values.

JWT Signing Key - Update Locations

The AUTHENTICATION.secretKey JSON property in the
/opt/hp/propel/sx/WEB-INF/classes/config/infrastructure.json file.

The security.encryptedSigningKey property in the
/opt/hp/propel/sx/WEB-INF/sx.properties file.

The idm.encryptedSigningKey property in the
/opt/hp/propel/idm-service/idm-service.war/WEB-INF/spring/applicationContext.properties file.

The securityEncryptedSigningKey property in the
/opt/hp/propel/jboss-as/standalone/deployments/consumption.war/WEB-INF/classes/csa.properties file.

The first two JWT signing-key locations (items 1 and 2) are under the sx.war directory, and will get encrypted automatically if both of their properties have an unencrypted value. For the final two locations (items 3 and 4), you must encrypt the value manually. (See Encrypt a Password - Service Manager Service Portal User Accounts for instructions on how to encrypt these values.).

Note: It is highly recommended that the signing key assigned by the Service Manager Service Portal Administrator is strong and long enough to survive brute force attacks. Any user with an IDM token (even an expired token) and knowledge about the authentication method may use this knowledge to perform a brute force attack without any rate limits in search of the secret signing key. Example: a strong and long key should be composed of 25 characters (including letters, digits, and some symbols), but not containing any dictionary words.

After making these password changes, you must restart Service Manager Service Portal for the changes to take effect. (See Restart Service Manager Service Portal for information to restart Service Manager Service Portal.)

Restart Service Manager Service Portal

To restart services on the Service Manager Service Portal host, do the following:

Run the following commands:

# propel stop

# propel start