Federation Manager Guide › Migrate Federation Manager to Use FIPS Encryption › How To Migrate from FIPS_COMPAT Mode to FIPS-Only Mode › Re-encrypt the Proxy Engine Agent Shared Secret

Re-encrypt the Proxy Engine Agent Shared Secret

To migrate, re-encrypt the shared secret for the proxy engine Web Agent.

To re-encrypt shared secrets

1. Open a command prompt window.
2. Navigate to the SmHost.conf file, located at federation-mgr_home\secure-proxy\proxy-engine\conf\defaultagent\SmHost.conf.
3. Enter the following command, using the values in the SmHost.conf file for some of the settings.

   smreghost -i policy_server_ip_address,port,port,port -u admin_user_name -p admini_password -hn host_name -hc host_config_object -f host_config_file_path -o -cf MIGRATE

   • policy_server_ip_address, port, port, port

     Specifies the IP address and port numbers of the policy engine. Look for the address in the SmHost.conf file. The default ports are 44441,44442,44443.

     You only have to specify the port numbers if you are using non-default ports. For non-default ports you can use the same number or different numbers for all three ports.

   • admin_user_name

     Specifies the name of the administrator. Enter siteminder for this value when using the smreghost utility.

   • admin_password

     Specifies the password for the Federation Manager administrator you specified during installation.

   • hostname

     Specifies the name of the trusted host that the policy engine uses for host registration. Enter a unique value for this parameter. Do not use the hostname in the SmHost.conf file because that host name already exists in the policy store.

   • host_config_object

     Indicates the name of the host configuration object that the policy engine uses. Look for the value of the hostname in the SmHost.conf file.

   • host_config_file_path

     Specifies the location of the SmHost.conf file.

   Example

   smreghost -i localhost -u siteminder -p mypassword
   -hn lfed-localhost20090511024942 -hc fed-localhost20090511024942
   -f "C:\Program Files\CA\FederationManager\secure-proxy\proxy-engine
   \conf\defaultagent\SmHost.conf" -o –cf  MIGRATE
   

   After executing this command, the re-encryption of the shared secret is complete.

4. Navigate to the SmHost.conf file, located at the following directory:

   federation-mgr_home\secure-proxy\proxy-engine\
   conf\defaultagent\SmHost.conf
   

5. Open the SmHost.conf file and verify that the shared secret is present and has a FIPS-approved algorithm prefix, such as {AES}.

Re-encryption of the shared secret is complete.