Migrating Accounts

With standard encryption, accounts are encrypted with cloud-managed keys. With Migrating Accounts, accounts are encrypted with public/private keys that you manage through a Groundplex on your local network.

When you Migrate accounts from one org to another org, consider the following:

The new accounts you create with import/migrate/metadata are automatically re-encrypted with destination org keys when you migrate the account from one org(source org) to another(destination), provided:

You are migrating the accounts from an org with standard account encryption to an org with standard or enhanced account encryption. In this case, the source org is required to be configured to recognize the destination org as a trusted org. Org admins can configure Organizational Settings to establish trust between orgs.
You are migrating the accounts from an org with enhanced account encryption to another org with enhanced account encryption. In this case, the customers are required to add the source org’s private keys to the JCC keystores in the destination org. The source private keys should be added with an alias name different from that of the destination key alias for alias names are unique in the keystore. A recommended name for source key alias will have org name preceded to the default ‘account-autogen’ key alias.
Because of the security risk, SnapLogic does not support migration of accounts from orgs with enhanced account encryption to orgs with standard account encryption. In this situation, you must manually recreate the accounts in the target org.

Projects with accounts exported prior to Release 4.11 will not have the accounts re-encrypted on import. You need to export the projects again and import in the target org.
If your org is configured for Enhanced Account Encryption, the SnapLogic Create Snap and the SnapLogic Update Snap enable you to create/update accounts when the sensitive fields are provided in plain text. The Snaps will encrypt the data automatically.

The presence of 'key' in the property tells the Snap that the field is already encrypted. Therefore, when the property value is in plain text, make sure you delete the 'key' field in the sensitive property object. Otherwise, the Snap cannot encrypt the field.

Migrating from One Enhanced Encrypted Org to Another

For re-encryption of accounts when they are migrated from one enhanced encrypted org to another enhanced encrypted org, the private keys of the source org should be available on all the JCCs of the destination org. Use the steps below to add the source keys to the keystores in the destination JCCs. The idea is to export and import source keys to the destination JCCs. This can be done using a keytool command either in a single step or multiple steps. Once the keys are added, the Snaplexes on the destination org can be restarted from the dashboard. The restarted JCCs will pick up the added source keys and use them during migration for account re-encryption.

Make a backup of both source and destination keystores before proceeding with adding the keys to the destination keystores.

Single Command

Run the following command on source keystore location. This command directly adds the keys to the destination keystore. It requires the host address of the destination machine.

keytool -importkeystore -srckeystore jcc-datakeys.jks
-srcstoretype JCEKS -srcstorepass `cat jcc-datakeys.pass` 
-srcalias 'account-autogen' -destkeystore <destination-machine>:<keystore-location>/jcc-datakeys.jks -deststoretype JCEKS 
-deststorepass <destination-machine>:<keystore-location>/jccdatakeys.pass -destalias source-account-autogen

Multiple-Step Process (Recommended)

Export the source key to a temporary keystore.

keytool -importkeystore -srckeystore 
jcc-datakeys.jks -destkeystore 
jcc-datakeys-src-copy.jks -srcstoretype JCEKS -deststoretype JCEKS -srcstorepass 
`cat jcc-datakeys.pass` -deststorepass changeit -srcalias account-autogen -destalias source-account-autogen -srckeypass 
`cat jcc-datakeys.pass` -destkeypass changeit

Both source and destination key-aliases are by default account-autogen. So while importing the source key to destination, a new name should be chosen for source key-alias. A recommended name would have source org name followed by account-autogen. For example, SnaplogicDev-account-autogen.
The keys are accessed by the same password that is used for the store that is stored in a .pass file. While exporting the source key to a temporary keyfile, use a temporary password. For example, changeit.

2. Copy the temporary keystore to the destination JCCs.

3. Go to the keystore in the destination JCCs. Import (add) the source key to the destination key using the following command:

keytool -importkeystore -srckeystore 
jcc-datakeys-src-copy.jks 
-destkeystore jcc-datakeys.jks -srcstoretype JCEKS -deststoretype JCEKS -srcstorepass changeit -srckeypass changeit -deststorepass `cat jcc-datakeys.pass` 
-srcalias source-account-autogen 
-destalias source-account-autogen

4. Change the source key password to use the keystore password.

keytool -keypasswd -alias 
source-account-autogen -keypass changeit 
-new `cat jcc-datakeys.pass`

5. Once the keys are added, you can list the keys to confirm that the source key is added with alias source-account-autogen

keytool -list -keystore jcc-datakeys.jks 
-storetype JCEKS -storepass `cat jcc-datakeys.pass`