rotateSealerKey.ps1

#this script reads the sealer key configuration from the IdP's idp.properties file and rotates the sealer key
Try {
  $ENABLE_SEALER_KEY_ROTATION = $env:ENABLE_SEALER_KEY_ROTATION
    }
Catch {
  $ENABLE_SEALER_KEY_ROTATION = 'True'
      }

If ($ENABLE_SEALER_KEY_ROTATION -eq 'True')  {
 #assure IDP_HOME
 Try {
  $IDP_HOME = $env:IDP_HOME
  If ($IDP_HOME = null$) {
      $IDP_HOME="c:\opt\shibboleth-idp"
        }
    }
 Catch {
  $IDP_HOME="c:\opt\shibboleth-idp"
      }
 #assure JAVA_HOME
 Try {
  $JAVA_HOME = $env:JAVA_HOME
  If ($JAVA_HOME = null$) {
      $JAVA_HOME="c:\zulujava\zulu-8"
        }
    }
 Catch {
  $JAVA_HOME="c:\zulujava\zulu-8"
      }

 #settings
 $IDPPROP=$IDP_HOME + "\conf\idp.properties"
 #item below is only used if you have configured additional hosts to sync your sealer to
 $SYNC_CRED="domain\user"

 #get config from properties file
 $storefile = (cat $IDPPROP | where { $_ -match "idp.sealer.storeResource"}).Split("=")[1].Trim().Replace("%{idp.home}", $IDP_HOME).Replace("/","\")
 $versionfile = (cat $IDPPROP | where { $_ -match "idp.sealer.versionResource"}).Split("=")[1].Trim().Replace("%{idp.home}", $IDP_HOME).Replace("/","\")
 $storepass = (cat $IDPPROP | where { $_ -match "idp.sealer.storePassword"}).Split("=")[1].Trim().Replace("{","`{").Replace("}","`}")
 $alias = (cat $IDPPROP | where { $_ -match "idp.sealer.aliasBase"}).Split("=")[1].Trim()
 try {
   $count = (cat $IDPPROP | where { $_ -match "idp.sealer._count"}).Split("=")[1].Trim()
    }
 catch {
   $count = 30
      }
 try {
   $sync_hosts = (cat $IDPPROP | where { $_ -match "idp.sealer._sync_hosts"}).Split("=")[1].Trim()
    }
 catch {
   $sync_hosts = $env:COMPUTERNAME
      }

 #Write-Host "Keystore:" $storefile
 #Write-Host "Version File:" $versionfile
 #Write-Host "Store Pass:" $storepass
 #Write-Host "Alias:" $alias
 #Write-Host "Count:" $count
 #Write-Host "Sync Hosts:" $sync_hosts

 #rotate key
 $cmd = "${IDP_HOME}\bin\runclass.bat net.shibboleth.utilities.java.support.security.BasicKeystoreKeyStrategyTool --storefile $storefile --storepass `$storepass --versionfile $versionfile --alias $alias --count $count"
 Invoke-Expression $cmd

 #display current/new version
 Write-Host "Current Key Version:" (cat $versionfile).split("=")[2].Trim()

 #sync to other hosts
 $sync_hosts.split(" ") | ForEach {
  If ($_.Trim() = $env:COMPUTERNAME) {Write-Host "***skipping sync to local host"} Else { 
	Write-Host "Syncing to: $_"
        $Session = New-PSSession -ComputerName "$_" -Credential $SYNC_CRED
	Copy-Item $versionfile -Destination $IDP_HOME\credentials -ToSession $Session
	}
 }

}