Microsoft Sharepoint Products and Technologies Resource Kit eBook

Creating the Encryption Key
Chapter 26: Single Sign-On in SharePoint Portal Server 2003 711
The encryption key is used as part of the encryption process for credentials used
with single sign-on. The key helps to decrypt encrypted credentials stored in the single
sign-on database. The first time you configure single sign-on and enterprise
application definitions on the Manage Server Settings for Single Sign-On page, the
encryption key is created automatically. You can regenerate the key if the previous
credentials are compromised or if you have a policy to change the key after a certain
number of days.
When you create an encryption key, you can choose to re-encrypt the existing
credentials with the new key. When you re-encrypt the SSOSrv service credential
store, events are logged in the Microsoft Windows Server 2003 application event log.
Once re-encryption is initiated, you can monitor the application event log to verify
that the credential store has been re-encrypted. Event ID 1032 is recorded in the
application event log when re-encryption is started. Event ID 1033 is recorded in the
application event log when re-encryption has ended. If there are any failures during
re-encryption, an event is recorded in the log.
If the job server is restarted or SSOSrv is stopped on the job server during the
re-encryption process, you should look in the event log for errors. If the event log
reports an error, you must restart the re-encryption process from the Manage
Encryption Key page.
Note If the re-encryption process is preempted in any way, it will have to
be re-run. If the re-encryption process is preempted, it reverts back to its
original state
The re-encryption process is a long-running operation. It is recommended that
you change or restore the encryption key during non-peak periods.
During the re-encryption process, Write operations such as updating credentials
and changing application definitions are not allowed. Read operations such as
retrieving credentials continue to work as normal.
Note To re-encrypt the existing credentials, the single sign-on service
account must be a member of the Server Administrators server role on the
SQL Server instance where the single sign-on database is located. For other
requirements for single sign-on service account, refer to the section “Single
Sign-On Service Account” earlier in this chapter.