You are viewing a plain text version of this content. The canonical link for it is here.

Posted to dev@ranger.apache.org by "Chinmay N Hegde (Jira)" <ji...@apache.org> on 2026/08/31 06:36:00 UTC

[jira] [Created] (RANGER-5776) Prevent DB2HSM migration tool from overwriting existing keys in HSM

Chinmay N Hegde created RANGER-5776:
---------------------------------------

             Summary: Prevent DB2HSM migration tool from overwriting existing keys in HSM
                 Key: RANGER-5776
                 URL: https://issues.apache.org/jira/browse/RANGER-5776
             Project: Ranger
          Issue Type: Bug
          Components: Ranger
    Affects Versions: 3.0.0
            Reporter: Chinmay N Hegde
            Assignee: Chinmay N Hegde


Currently, when the master key is migrated from the KMS DB to Luna HSM using the migration tool ({*}DB2HSMMKUtil{*}), it silently overwrites any existing key present in the HSM. This overwrite should never happen, as it could lead to loss of data if the HSM already holds the active master key.

The fix must be added to check the presence of alias in HSM before writing to the HSM. If the alias is already present, the write is skipped and a warning is logged. 
This brings the behaviour in sync with how *HSM2DBMKUtil* works.
(Note: This also needs to be fixed on *RangerSafenetKeySecure* side)



--
This message was sent by Atlassian Jira
(v8.20.10#820010)