MFT-4223 Encryption algorithm or key length is restricted under the java policy

If you are handling encrypted files with MFT, encryption algorithms/strength of public keys (key sizes) are critical components which require attention from a security standpoint. Algorithms such as RSA, DSA etc  and  keys with lengths greater than 2048 bits are usually considered secure. 

MFT 12c provides command line tools to generate PGP key pair, however as per Oracle MFT documentation,

“Our PGP generation tool is basic and intended for development. For production, you should generate PGP key pairs externally using some other tools and import it in MFT. By Default the PGP Generator of MFT uses the Bouncy Castle API with hard coded parameters, i.e 1024 Bytes, Expiry Date as Unlimited. The MFT PGP Generator has very limited functionality.”

So if you are using PGP keys generated from an external tool with key sizes 2048/4096 bits there is a likelihood that your MFT transfer (decryption pre processing action) has failed with below exception

Cause	Encryption algorithm or key length is restricted.
Action	Make sure algorithms and key used is not restricted under java security policy.
Error Description	MFTException [threadName=JCA-work-instance:JMSAdapter-7, errorID=3e8d5a86-a2db-4a80-b548-00c0edb4a37c, errorDesc=MFT-4223_Encryption algorithm or key length is restricted under the java policy., cause=Illegal key size or default parameters

 In order to get rid of this exception, you will have to follow below steps:

• Download the "Unlimited" jars "local_policy.jar" and "us_export_policy.jar" from Oracle website specific to your JDK version. Example: http://www.oracle.com/technetwork/java/javase/downloads/jce-7-download-432124.html
• Make a backup of the "limited versions" in $JAVA_HOME/jre/lib/security/
• Replace the limited jars with the unlimited jars.
• Restart managed servers and retry your MFT transfer.

Sending Error Notifications in MFT 12c

Oracle SOA Suite 12c introduced a new product called Managed File Transfer (MFT). Basically MFT is a centralized file transfer solution for enterprises which addresses several pain points wrt. file transfers

• It provides secure access to file transfers, tracking each and every step of the end to end file transmission.
• Easy to use UI for designing, monitoring and administering the file transfer solution which can be used by non-technical staff as well
• Extensive reporting capability with detailed status tracking and options to resubmit failed transfers. 
• Built-in support for many pre and post processing actions like compression/decompression, encryption/decryption(PGP etc.) which in turn means no need to write custom code for these actions.
• Out of the box support for many technologies including SOA and OSB which in turn leads to multiple integration pattern possibilities. Example: for a large payload processing MFT can simply consume the source file and pass it as a reference to SOA target for chunk read and transformation.
• Integration with ESS (Enterprise Scheduler Service) which is another new product feature in 12c allowing to create flexible schedules for the file transfers without having to write any custom code (quartz, control M scripts, cronjobs etc).

Even though the centralized monitoring dashboard in MFT console is robust and provides granular details of each phase of file transfer (eg: if the target systems are SOA it has embedded links to the EM Console for tracing the status there as well.) there maybe a need to send out email alerts for reporting file transfer failures to a support distribution list in a typical production environment (cannot expect people to keep monitoring the dashboard all the time).

Below are high level steps to enable email notifications in MFT 12c.

Step1:

Run the below WLST commands in sequence to enable the event and add contact for email notification: 

o   cd ${MW_HOME}/mft/common/bin

o   ./wlst.sh

o   connect("weblogic","xxxx","t3://hostname:port")

o   updateEvent('RUNTIME_ERROR_EVENT', true)

o   createContact('Email', 'abc@xyz.com' )

o   addContactToNotification('RUNTIME_ERROR_EVENT', 'Email', 'abc@xyz.com')

o   disconnect()

o   exit()

Step2: 

Configure the Email Driver for notifications. Basically set the Outgoing Mail Server and the port (mandatory ones)

 You have to restart the MFT managed server after changing these settings.

Step3: 

Try replicating a file transfer error and monitor the error both in Monitoring Dashboard as well as check for the error email in outlook.

NOTE:

If event listed above is not enabled or no contacts are specified, then notification messages are sent to JMS “MFTExceptionQueue”.