By: Mursel Koseer user 25 Nov 2024 at 9 a.m. CST

6 Responses
Mursel Koseer gravatar
We have two Gluu servers. Does Gluu offer a feature to regenerate the keys for ALL the servers, rather than just one server?

By Michael Schwartz Account Admin 25 Nov 2024 at 11:06 a.m. CST

Michael Schwartz gravatar
Yes... using cluster manager in Gluu 4 you can centrally control key regeration. Raju can help you.

By Md Mostafejur Rahman staff 26 Nov 2024 at 1:12 a.m. CST

Md Mostafejur Rahman gravatar
Hi Mursel Koseer, Here is cluster manager [docs](https://gluu.org/docs/cm/). I'm setting up an environment. I will let you know the update. regards~ Mostafejur Rahman

By Mursel Koseer user 26 Nov 2024 at 3:46 a.m. CST

Mursel Koseer gravatar
Hi, So the 'Key Rotation' feature in the cluster manager ensures that all Gluu servers have the same public keys in LDAP and the same private keys in their file systems and are aware of these changes? Currently, we're using 'keyRegeneration' on Gluu servers with LDAP and file system replication to synchronize keys across servers. However, we frequently encounter key mismatches because some servers continue using outdated keys, as they aren't aware of the latest changes (because this is regenerated in the other server).

By Aliaksandr Samuseu staff 03 Dec 2024 at 6:34 p.m. CST

Aliaksandr Samuseu gravatar
Hi, Mursel. Could you double-check if "keyRegenerationEnabled" property is set to "true" on the "Configuration" > "JSON Configuraiton" > "oxAuth" page? In clustered setups it must be disabled and the key rotation should be handled by CM's script. Could you share screenshots of the corresponding configuration pages from CM's web console? Also, have you followed this instruction in the docs to add keygen.jar to CM's javalibs directory? https://gluu.org/docs/cm/4.4/installation/#add-key-generator

By Mursel Koseer user 04 Dec 2024 at 12:52 a.m. CST

Mursel Koseer gravatar
Hi Aliaksandr, I have put the property "keyRegenerationEnabled" to "false" in our 2 gluu servers. I have followed the link for adding the keygen.jar but when i open the "Key Rotation" page in the CM, I get this error "Traceback (most recent call last): File "/usr/local/lib/python3.10/dist-packages/flask/app.py", line 1484, in full_dispatch_request rv = self.dispatch_request() File "/usr/local/lib/python3.10/dist-packages/flask/app.py", line 1469, in dispatch_request return self.ensure_sync(self.view_functions[rule.endpoint])(view_args) File "/usr/local/lib/python3.10/dist-packages/flask_login/utils.py", line 290, in decorated_view return current_app.ensure_sync(func)(*args, kwargs) File "/usr/local/lib/python3.10/dist-packages/clustermgr/views/keyrotation.py", line 49, in index kr.type = get_key_type() AttributeError: 'NoneType' object has no attribute 'type'" Which configuration pages do you want to see in the CM? And how can i put my local screenshots in this ticket, because it asks for a url?

By Mursel Koseer user 05 Dec 2024 at 2:06 a.m. CST

Mursel Koseer gravatar
Hi Aliaksandr, We have resolved this issue. The problem was in the script located at /usr/local/lib/python3.10/dist-packages/clustermgr/views/keyrotation.py. On the index page, it sends a query to find the "first" value of the configuration. However, during the first-time use, the configuration is None. We discovered that navigating manually to the /settings endpoint via the address bar allows us to save the settings. This action configures the necessary settings, enabling the index page to function correctly. I believe this is a bug because, when kr is None, the application should automatically redirect to the settings page to complete the initial configuration.