Secure Password Management

Since product version 5.23.0, an environment encryption key is used to encrypt and decrypt application passwords. For more information on this topic, refer to the Master Security Guide Cloud - Password Management.

Only one environment encryption key can be active at a time. It is advised to create a set of environment encryption keys and change the active key periodically, according the password policy. It is recommended to do this at least once a year.

In Cloud environments, the keys are maintained by Kubernetes secrets so all applications can reach the key.

Storemanager and Configuration Service and the rest of the central applications need to access the encryption keys in the server's environment.

Environment Encryption Key Rotation

The rotation of the active key is done from the Employee Hub using the Encryption Key Status function in the Service section. For more information about this function, see Employee Hub function documentation.

Process description:

  1. Log in to Employee Hub as a Global Administrator user
  2. Navigate to the Service section and launch the Encryption Key Status function
  3. Activate the new encryption key
  4. The previous active encryption key is marked as Obsolete
  5. Storemanager automatically recalculates the configuration (passwords are encrypted by the newly activated key)
  6. Restart the application cluster
  7. Applications are started with new passwords