Table of Contents

Search

  1. Preface
  2. Introduction to Dynamic Data Masking Administration
  3. Authentication
  4. Security
  5. Connection Management
  6. JDBC Client Configuration
  7. ODBC Client Configuration
  8. Configuration for MicroStrategy
  9. Access Control
  10. Logs
  11. High Availability
  12. Server Control
  13. Performance Tuning
  14. Troubleshooting
  15. Appendix A: Database Keywords

Administrator Guide

Administrator Guide

Truststore Configuration

Truststore Configuration

To configure SSL communication in Dynamic Data Masking, copy truststores from the database client to the Dynamic Data Masking Server. Usually you can copy the client truststores without changing them. After you copy the truststores to the Dynamic Data Masking Server installation, configure the
cfg/ddm.security
file to set the truststore parameters.
If necessary, you can configure the trust strategy to accept new database certificates at run time, and permanently store them in the preferred truststore.
The following table describes the truststore properties that you configure in the truststore section of the
cfg/ddm.security
file:
Parameter Name
Description
Required
Default Value
storeType
Type of truststore, for example JKS, JCEKS, or PKCS12.
Yes
storeFile
Path to the truststore file.
No
storePassword
Password for the truststore.
No
provider
Name of the specific security provider that works with the truststore.
No
encrypted
If set to "true," Dynamic Data Masking encrypts unencrypted passwords at run-time.
No
false
preferred
If set to "true," Dynamic Data Masking loads the preferred truststore first, before any other truststores.
Dynamic Data masking can add new certificates to the preferred truststore at run time. If you do not set a preferred truststore, Dynamic Data Masking might use new accepted certificates for the duration of current session. For more information, see Trust Strategies.
You can set one preferred truststore in the
cfg/ddm.security
file.
No
false
At run time, Dynamic Data Masking loads truststores and checks trusted certificates in the following order:
  1. The preferred truststore, specified in the
    cfg/ddm.security
    file.
  2. Truststores specified using the Java Virtual Machine system property command-line options, for example in the file
    jvm.params
    .
    • javax.net.ssl.trustStore
    • javax.net.ssl.trustStoreType
    • javax.net.ssl.trustStorePassword
    • javax.net.ssl.trustStoreProvider
  3. A truststore of the Java Virtual Machine, if any.
  4. Other truststores specified in the
    cfg/ddm.security
    file.
If you do not configure the Dynamic Data Masking administrative tools with truststores in the file
cfg/client.security
, the administrative tools accept any signed certificate that the Dynamic Data Masking Server provides.
Note that JDBC database drivers can use only one truststore with all public certificates which is set in the Java Virtual Machine system properties.
The Dynamic Data Masking Server automatically generates a composite temporary truststore file named
cfg/ddm.temp.jceks
.
This truststore is used to discover metadata in SSL-enabled databases and perform impersonation in Dynamic Data Masking. It is also used to test the connection to SSL-enabled databases through the
Add Database
form.
The composite truststore file contains entries added from all configured truststores, including the truststore defined in the Java Virtual Machine system properties. That composite truststore is set, and can override an existing truststore, in the Java Virtual Machine system properties. The Dynamic Data Masking Server always creates a new temporary composite truststore at startup for the current Dynamic Data Masking Server session. The Dynamic Data Masking Server also deletes the old temporary composite truststore, if it remains after a previous session.
The temporary composite truststore is used to support the functionality of JDBC drivers in the Java Virtual Machine. If you have not configured the Dynamic Data Masking Server to work with SSL-enabled databases, the Dynamic Data Masking Sever does not generate the composite truststore.

0 COMMENTS

We’d like to hear from you!