How to Configure Encryption

This information is applicable to SmartHub  v5.4.0.0-c19190 and later.

• SmartHub does not encrypt passwords stored in configuration by default. 
• To secure passwords configure SmartHub to encrypt them

Environment Variables

Password encryption requires the following environment variables to be set:

• BAInsightSecurityEncriptionKey
  
  • The value of this environment variable is used as key encryption algorithm.
  • Example: RgUkXp2s5v8y/B?E(H+KbPeShVmYq3t6
• BAInsightSecuritySaltKey
  • The value of this environment variable is used as a salt key for the encryption algorithm.
  • Note that BAInsightSecuritySaltKey value must be at least 8 characters. 
  • Example: TjWnZr4u7x!A%D*G-KaPdRgUkXp2s5v8

After changing BAInsightSecurityEncriptionKey and BAInsightSecuritySaltKey you'll need to perform an iisreset.

Note: If you want to change your encryption and / or salt keys, first you must use the SmartHub Encryption Tool to decrypt the current configuration.

Note:  If you use more BA Insight products that uses this encryption mechanism, the same keys are used for all such products.
If you don't know this information, please contact BA Insight Support Team. 

Note: If you install SmartHub in a multi-server environment, you need to set up the same environment variables on all the servers running SmartHub 

Note: The priority of reading the values from the environment variables is User Environment Variables and then, if user variables are not set, the System Environment Variables are checked.
If you want to have multiple user accounts running multiple BA Insight products that use this encryption mechanism, you can either set up the environment variables for each of the users, or set up the system environment variables.
Note that System environment variables are accessible for all users and this may not align with your security policy. 

SmartHub Encryption Tool

Note: For information about how to use the SmartHub Encryption tool to change encryption keys, see "How to Use the SmartHub Encryption Tool to Change the Encryption Keys," below.

SmartHub Encryption Tool uses two folders:

• encryptedFilesFolder
  • Contains the encrypted configuration files,
  • The default value points to the SmartHub configuration directory: "../../Configuration"
• decryptedFilesFilesFolder
  • Contains the decrypted configuration files
  • The default value points to the path "../../Configuration/Decrypted"

Using the SmartHub Encryption Tool

The SmartHub Encryption Tool can be found in <SmartHubRootFolder>\Tools\EncryptionTool.

Run the tool via the file BAInsight.EncryptionTool.exe.

The regular steps are "Decrypt" and then "Encrypt". See the image above.

• Decrypt
  • When choosing the decrypt option, the configuration files from the encryptedFilesFolder will be decrypted and saved in the decryptedFilesFilesFolder
• Encrypt
  • When choosing the encrypt option, the configuration files from decryptedFilesFilesFolder will be encrypted and saved in the encryptedFilesFolder.

For Users of Earlier SmartHub Versions (pre-v5.4)

If you upgrade from a SmartHub version earlier than v5.4.0.0-c19190,the configuration is encrypted with a key that is no longer supported.

In this case, perform the following steps:

1. Make a backup of the Configuration folder.
2. Use the Encryption Tool to decrypt the configurations. 
   1. If you do not want to use encryption, manually copy the files from the decryptedFilesFilesFolder in the Configuration folder.
   2. Otherwise, use the Encryption Tool to encrypt the files from the decryptedFilesFilesFolder.
   3. If needed, manually copy the files from the encryptedFilesFolder in the Configuration folder 

How to Use the SmartHub Encryption Tool to Change the Encryption Keys

1. Make a backup of the Configuration folder.
   
2. Use the Encryption Tool to decrypt the configurations. 
   
3. Update the environment variables: BAInsightSecurityEncriptionKey andBAInsightSecuritySaltKey
   
4. Otherwise, use the Encryption Tool to encrypt the files from the decryptedFilesFilesFolder.
   1. If needed manually copy the files from the encryptedFilesFolder in the Configuration folder.

Common Errors

If seen, the following errors indicate that the configurations have not been upgraded.

See "How to use the SmartHub Encryption Tool to change the encryption keys," above.

This typically indicates that the environment variables are configured, but the current configuration uses an obsolete encryption key.

It usually indicates that the environment variables are not configured, and the current configuration uses an obsolete encryption key.