# Tenant Key Pair Migrator Client

* The Tenant Key Pair Migrator Client is used to update tenant key pairs in the key store to ensure that public keys
  meet a minimum size of 2048 bits.
* If a tenant key pair is less than 2048 bits, the tenant key pair migrator client will generate a new key pair with
  public key size 2048 bits and update the key pair in the tenant key store.

# How to use the client

* Before starting the migration process, make sure to take a backup of the existing Identity Server database.
* Unzip the new Identity Server distribution (use U2 updated distribution if possible). This will be used as the
  tenant key pair migrator tool. We will refer to this Identity Server distribution as “keypair migrator tool” and
  location as `<KEYPAIR-MIGRATOR-HOME>`.
* This distribution with below-mentioned changes will be used as another node for the migration process.
* Build the project and copy the jar file in the target to the `<KEYPAIR-MIGRATOR-HOME>/repository/components/dropins`
  directory.
* Copy the `tenant-key-migration-resources` folder in the `resources` directory to the `<KEYPAIR-MIGRATOR-HOME>` directory.
* Update the `tenant-key-migration-config.yaml` file in the `<KEYPAIR-MIGRATOR-HOME>/tenant-key-migration-resources` directory with the
  required configurations.
* Following configurations are available in the `tenant-key-migration-config.yaml` file.

| Property               | Description                                                                                                                 | Mandatory/Optional | Default value |
|:-----------------------|:----------------------------------------------------------------------------------------------------------------------------|:-------------------|:--------------|
| migrationEnable        | Enable tenant key pair migration                                                                                            | Mandatory          | false         |
| reportPath             | Path to the report directory. If no path is provided, the report will be added to tenant-key-migration-resources directory. | Optional           | -             |
| migrateSpecificTenants | Enable tenant key pair migration for specific tenants                                                                       | Mandatory          | false         |
| tenantsToMigrate       | List of tenants to migrate                                                                                                  | Optional           | -             |

* Below is a sample configuration for the `tenant-key-migration-config.yaml` file.

```yaml
# This file contains the configurations related to tenant key migration.

# Enable tenant key migration
migrationEnable: false
# Path to the report directory
reportPath: "/home/user/tenant-key-migration-report-directory"
# Enable tenant key migration for specific tenants
migrateSpecificTenants: false
# List of tenants to migrate
tenantsToMigrate:
  - "abc.com"
  - "xyz.org"
  - "wso.com"

```

* Configure the `tenant-key-migration-config.yaml` file with the required configurations.
* Start the Identity Server by running the `wso2server.sh` or `wso2server.bat` script.
* Observe the logs to see the tenant key migration process. Migration completion log:
  `INFO {org.wso2.is.tenant.key.migration.client.TenantKeyMigrator} - WSO2 Product Tenant Key Migration Service Task : Tenant key migration completed successfully.`
* Stop the Identity Server node after the migration process is completed.