The resulting code in your deployment descriptor should look like this:

<context-param>
<param-name>WFENCR</param-name>
<param-value> 
ibi.webfoc.wfsecurity.encryption.wiretripledes.WFWireTripleDESKeyFile 
</param-value>
</context-param>
<context-param>
<param-name>WFENCR_KEY_INFO</param-name>
<param-value>c:\ibi\keyfile.dat</param-value>
</context-param>

The encryption key information is stored in a plain text file and is represented by a sequence of bytes in hexadecimal notation. A hexadecimal byte is represented by two digits. Each digit is either a number (0-9) or a letter (A-F). The key file must contain eight hexadecimal bytes for a DES key and 24 hexadecimal bytes for a Triple DES key.

It may seem that more data is specified in the key file than is required (8 bits per byte times 24 bytes is 192 bits, which is greater than the 168 bits usually required for Triple DES). However, 192 bits are required when using a plain text file with these algorithms.

WFENCR is used to encrypt both transient data (WebFOCUS cookies and Managed Reporting sign-on tickets) and persisted data (Managed Reporting passwords). Changing an encryption algorithm or an encryption key renders persisted data unreadable. If you are using the built-in Managed Reporting Repository for authentication or are storing Dashboard credentials for the Public View or for WebFOCUS Reporting Server authentication, you must reset those passwords after adding or changing a WFENCR or WFENCR_KEY_INFO setting.

To reset passwords in the built-in Managed Reporting user directory (user.htm) after changing WebFOCUS encryption settings, do the following:

This process is tedious so consider your implementation choices carefully. For example, configure WebFOCUS with a strong encryption provider from the start so you do not have to change it later. Consider also using the Managed Reporting Realm Driver to authenticate users to an external directory such as Active Directory or LDAP. In this case, passwords are not maintained in the user.htm file.

Note: In a future release, Information Builders plans to create separate settings for encrypting transient and persisted data. This will allow for the possibility of a dynamically generated internal key, external key store, and key rotation.

The DES and Triple DES algorithms were developed with Sun Java Cryptography Extension (JCE) framework and currently implement only the Sun JCE provider class. Review the following scenarios to verify support for your Application server:

• If you are running WebFOCUS inside a Java Application server (or servlet engine) that runs on Sun J2SDK 1.4.1 or higher, you do not need to take any action. The Sun JCE provider is included.
• If you are running J2SDK 1.4.1 or higher of another vendor, check their documentation to see if the Sun JCE provider is available in that implementation. For example, WebSphere 5.1 for HP-UX ships with a version of HP J2SDK 1.4.1 that has both the Sun and IBM JCE providers. However, WebSphere 5.1 for AIX ships with an IBM J2SDK 1.4.1 that has only the IBM JCE provider and is therefore not currently supported by the optional encryption providers supplied by Information Builders.
• If your Java Application server is running on J2SDK 1.3.x (from any vendor), you must download and configure Sun JCE 1.2.2. For example, WebSphere 5.0 on AIX ships with IBM J2SDK 1.3.1, which is only supported when you download and configure the Sun JCE.

  You can obtain the Sun JCE 1.2.2 software and installation documentation by accessing the JCE Downloads section on Sun Java Technology Web site.

• To build the alternate encryption provider, you must add the \ibi\WebFOCUS76\webapps\webfocus76\WEB-INF\lib\webfoc.jar file to the build classpath for your WebFOCUS Servlet Alternate Encryption project.
• To enable the alternate encryption provider, add WFENCR as a context parameter to the WebFOCUS Web application so that it will be available for WebFOCUS, Managed Reporting, and Dashboard. The change is made to the deployment descriptor file, \ibi\WebFOCUS76\webapps\webfocus76\WEB-INF\web.xml:

  <web-app>  ...  ...  <context-param>  <param-name>WFENCR</param-name>  <param-value>ENCRYPTION EXIT CLASS NAME GOES HERE</param-value> </context-param>

The following sample code overrides WebFOCUS built-in encryption and encodes the WebFOCUS cookie. This sample does not provide any encryption algorithm.

package exits.wf;
import ibi.webfoc.wfutil.WFEncryptionInterface;
 
public class WfEncryptionExit implements WFEncryptionInterface
{
/**
 * Constructor for WfEncryptionExit.
 */
public WfEncryptionExit()
{
super();
}
 
/**
 * Apply custom encryption algorithm.
 * @param cookie
 * @return Encrypted cookie string
 */
 
public String encrypt(String cookie)
{String rCookie;
rCookie= java.net.URLEncoder.encode(cookie);
return rCookie;
}
/**
 * Apply custom decryption algorithm,
 * @param cookie
 * @return Decrypted cookie string
 */

public String decrypt(String cookie)
{
String rCookie;
rCookie= java.net.URLDecoder.decode(cookie);
return rCookie;
}
 
/**
 * Determines if a EBCIDIC to ASCII translation is performed.
 * @param cookie
 * @param convert
 * @return String
 */
public String decrypt(String cookie, boolean convert)
{
String rCookie;
rCookie= java.net.URLDecoder.decode(cookie);
return rCookie;
}
}