RFE-224

Reduce SAKA build size

As the software in the SAKA stack (e.g., JDK, LDAP, etc.) is updated, newer SAKA distributions include packages to ensure the new software is available when an appliance cannot access the internet to download them directly. Over time, the size of the SAKA distribution has increased while older software packages still remain in the build.

In an effort to reduce the size of the SAKA build, the following measures have been taken:

• Unused JDK packages are now excluded by the SAKA build creation tool.
  
  
• Unused OpenLDAP packages are now excluded by SAKA build creation tool.
  
  
• Removed a duplicate set of libraries in the $STRONGAUTH_HOME/lib/ directory. It is now a symbolic link in new SAKA builds (4.14.0+).
  

RFE-228

Disable and re-enable replication during SAKA upgrade

Prior to SAKA version 4.14, StrongKey has asked customers to disable replication before running the upgrade script and re-enable replication when the script finishes. Sometimes customers would forget to re-enable replication, causing issues with missing replication data.

Instead of handling this process manually, the upgrade script now automatically disables replication ports during upgrade script execution to prevent replication issues.

RFE-251

Increase Timeout during reboot for MariaDB service

There are some cases where the MariaDB service takes longer than usual to start up post-reboot of the appliance. This increased start up time would then cause the service to time out, thus preventing MariaDB from starting.

To prevent this, the MariaDB service's timeout has been increased to 900 seconds.

RFE-252

Update upgrade instructions to reflect new systemd unit name for Payara

Messaging in SAKA upgrade script has been updated from "Glassfish" to "Payara".

BUG-73

Fix SafeNet (Thales) ProtectServer 3 domain creation failed with FIPS mode enabled

There was a problem where the server was not able to wrap/unwrap symmetric keys using the normal Java KeyStore object with FIPS mode enabled on the SafeNet HSM causing the domain creation process to fail.

The code has been updated to wrap/unwrap keys using the keystore objects provided by the HSM manufacturer.

The server also now assigns a label to the newly-created private key. This label can be used to help migrate one domain at a time.

BUG-109

Fix Payara restart post-Rocky migration

Similar to RFE-251, the Payara service would sometimes take longer to start up post-reboot of the appliance. This increased start up time would then cause the service to time out, thus preventing Payara from starting.

To prevent this, the Payara service's timeout has been increased to 900 seconds.

In addition, an error would occur when the Payara service would start up faster than the MariaDB service. This would cause errors in the log since the SAKA server could not access the local database. The Payara service now starts after waiting for MariaDB service to start.

BUG-117

Fix SAKA bundles not picking up Java options

Windows, Mac, and Linux SAKA Tool bundle scripts now include the JDK_JAVA_OPTIONS (introduced in 4.13.0 with the move from JDK 11 to JDK 21) necessary to make requests to the SAKA server.

This change has also been added to SAKA versions 4.13.3+.

BUG-118

Fix Cross-Server BDK and TPK token retrieval error during RPB

Fixed error that occurs when ReEncrypt Pin Block (RPB) web service is called and the BDK and TPK used for the transaction are originally stored on different SID's.

During the RPB web service, the SID is retrieved from the BDK request and the same SID was being used to retrieve the symmetric key to decrypt the TPK. If the TPK was originally encrypted on a different SID, it would not decrypt correctly which would lead to the following error:

CRYPTO-ERR-1006: Unsupported cryptographic transform: AES/GCM/NoPadding]]

If the TPK for was loaded to the cache prior to this transaction, the server would successfully perform the RPB transaction and so it did not fail 100% of the time.

BUG-120

Fixed out of order null check in getJsonValue in non-standalone SKFS (SAKA) environments

Mismatch between common method "getJsonValue" in SAKA-FS and standalone SKFS environments, where a null check was being done too early in SAKA-FS.

BUG-121

Fix SKL-ERR-1000 error message being printed in successful encryption requests

Sometimes a benign "SKL-ERR-1000" error was logged as an additional line during the SAKA encryption REST webservice even in successful transaction. This log would have no impact on encryption functionality.

Example of error log:

SKL-ERR-1000: Caught an exception: [TXID=XXX-1732137068, START=1732137068, FINISH=1732206488, TTE=XXX]

This extra log has been removed.