Installation and Upgrade Guides › SiteMinder Upgrade Guide › Using FIPS-Compliant Algorithms › How to Re-Encrypt Existing Sensitive Data › Re-encrypt Policy and Key Store Data › Re-encrypt the Policy Store Data

Re-encrypt the Policy Store Data

To re-encrypt the policy store data

1. Open a command prompt from the machine hosting the Policy Server and navigate to the location to which you want to export the policy store data file.
2. Run the following command:

   XPSExport outputfile -xa -passphrase phrase -vT -vI -vW -vE -vF -e file_name -l log_file
   

   Note: Although you can use XPSExport to export one or more granular objects, this procedure provides the arguments for exporting all of the policy store data. This ensures that the export includes all of the sensitive data. More information on exporting one or more granular objects exists in the Policy Server Administration Guide.

   • outputfile

     Specifies the name of the XML output file.

     Note: The file name must be unique. The export fails if a file with the same name exists.

     Example: psdata

   • -xa

     Specifies that all of the policy data is to be exported.

   • -passphrase phrase

     Specifies a passphrase required for encryption of sensitive data. Record this value as it is required to import the sensitive data back into the policy store.

     Limit: The passphrase must be contain at least:

     • Eight (8) characters
     • One (1) digit
     • One (1) upper-case character
     • One (1) lower-case character

     Note: If the passphrase contains spaces, enclose it in quotes (").

   • -vT

     (Optional) Sets verbosity level to TRACE.

   • -vI

     (Optional) Sets verbosity level to INFO.

   • -vW

     (Optional) Sets verbosity level to WARNING (default).

   • -vE

     (Optional) Sets verbosity level to ERROR.

   • -vF

     (Optional) Sets verbosity level to FATAL.

   • -l log_path

     (Optional) Outputs log to the specified path.

   • -e file_name

     (Optional) Specifies the file to which errors and exceptions are logged. If omitted, stderr is used.

   XPSExport exports the policy store data and places the data file in the directory from which you ran the tool.

3. Run the following command:

   XPSImport input_file -passphrase phrase -vT -vI -vW -vE -vF -l log_path
   

   • input_file

     Specifies the input XML file.

   • -passphrase phrase

     Specifies the passphrase required for the decryption of sensitive data.

     Limit: The phrase must match the phrase you specified during export or the decryption fails.

   • -vT

     (Optional) Sets verbosity level to TRACE.

   • -vI

     (Optional) Sets verbosity level to INFO.

   • -vW

     (Optional) Sets verbosity level to WARNING (default).

   • -vE

     (Optional) Sets verbosity level to ERROR.

   • -vF

     (Optional) Sets verbosity level to FATAL.

   • -l log_path

     (Optional) Outputs log to the specified path.

   • -e file_name

     (Optional) Specifies the file to which errors and exceptions are logged. If omitted, stderr is used.

   XPSImport imports the data into the policy store. Sensitive data is encrypted using FIPS-compliant algorithms.

If your environment users Basic Password Services, you may now verify that the Password Blobs are re-encrypted using FIPS-approved algorithms.