client_secret in the IMS configuration is getting unset
This article provides a resolution to the issue where the IMS configuration fails after an AEM restart. The health check associated with IMS configurations consistently fails, indicating an inability to authenticate using the configured client_secret. Save the crypto keys in the Bundle’s file storage.
Description description
Environment:
Experience Manager
Issue/Symptoms
client_secret in the IMS configuration is getting unset.
After upgrading AEM from older versions (e.g., 6.2 or below) to newer versions (6.3 or above), the method for storing crypto keys changes from JCR storage to filesystem storage. This change requires manual intervention to ensure that the hmac and master keys are correctly relocated for AEM to function properly after a restart. Failure to do so can result in authentication problems with services like IMS, as the keys used to encrypt and decrypt sensitive information are not found in the expected location.
The following error is seen:
{"error":"invalid_client","error_description":"invalid client_secret parameter"}
Resolution resolution
To resolve this issue and ensure that IMS configurations remain stable across AEM restarts, follow these steps:
-
Go to crxde and navigate to /etc/key. Inside that node, there should be a master property and a hmac property. Download those files.
-
Download the property by clicking on the values for those properties.
-
Go to
<hostname>/system/console/bundlesand search for “Crypto” -
Note the bundle ID for the bundle labeled "Adobe Granite Crypto Bundle Key Provider com.adobe.granite.crypto.file.
-
Note the bundle ID for the bundle labeled “Adobe Granite Crypto Support com.adobe.granite.crypto”.
-
Stop AEM.
-
On your AEM server, navigate to Navigate to
crx-quickstart/launchpad/felix/< bundleID> /data, where<bundleID>is from step 5 -
There is a file named storage in the data directory, download this storage file and replace the one currently on the server. You must replace the file instead of just changing the value from JCR to Bundle because the file must not have a newline char at the end, most editors like vi add a newline char.
-
Go to the directory
crx-quickstart/launchpad/felix/bundle${FILE_BUNDLE_ID}/data, where ${FILE_BUNDLE_ID} is replaced by the “Bundle Id” value from step 4 (the com.adobe.granite.crypto.file bundle ID). -
Copy the hmac and master files that you downloaded in step 2 to this location.
-
Verify the hmac and master files are the same as the ones you downloaded.
-
The commands would be:
md5sum hmac md5sum masterEnsure that the output is the same for the downloaded files and the replaced files.
-
Start AEM.
-
Remove the hmac and master properties from /etc/key and make sure to save.
-
By following these steps, you relocate the crypto keys from the JCR to the filesystem, aligning with the storage method expected in newer AEM versions. This ensures that AEM can consistently access the keys for encryption and decryption operations, thereby maintaining stable IMS configurations across restarts. It is recommended to test these changes in a lower environment before applying them to production systems.