PGP Unpackage Service
Pretty Good Privacy (PGP) is an open standard data encryption and decryption tool. The PGP Unpackage service, with the PGP Server Manager, decrypts documents and verifies their signatures.
The following table provides an overview of the PGP Unpackage service:
Category | Description |
---|---|
System name | PGP Unpackage service |
Graphical Process Modeler (GPM) category | All Services |
Description | This service is used to decrypt and verify the signature of a document based on the Open PGP standard, by using a public key or conventional cryptography. |
Business usage | Use this service to decrypt or verify the signature of the document in the document area. |
Usage example | A business process is executed to decrypt or verify the signature of the document based on the PGP profile. See PGP Server Manager. |
Preconfigured? | Yes |
Requires third-party files? | No |
Platform availability | All supported Sterling B2B Integrator platforms, with a supported PGP software version installed that is also supported for the installed version of Sterling B2B Integrator. |
Related adapters | The PGP Unpackage service works with the following
services:
|
Application requirements | Before using this service, install one of the supported PGP software versions. For more information, see Create a PGP Server Profile. |
Initiates business processes? | This service does not initiate business processes. This service cannot be used without a business process. |
Invocation | A user who has permission to perform this activity must execute the business process that invokes this service. |
Business process context considerations | The configuration parameters and the outgoing documents are picked up by the service in the business process context. In the receiving mode, the service puts the incoming documents into the business process context. |
Returned status values | Returned status values:
|
Restrictions | None |
Persistence level | None |
Testing considerations | Create the profile in the PGP Server Manager. This profile stores information about the PGP server, including PGP Type, PGP Executable, PGP Path, the location of the public key ring, the secret key ring, and the random number seed. It enables you to create key maps for secret key sets and conventional key sets. A pre-defined Command Line Adapter 2 (PGPCmdlineService) is installed with Sterling B2B Integrator. The Command Line Adapter 2 is used for large file support (streaming). Start the remote Command Line 2 client. For more information about enabling and installing the Command Line Adapter 2, see Command Line Adapter 2 (V5.2.4.1 and interim fix 5.2.4.1_2 or later). |
Implement the PGP Unpackage Service
- Activate your license for the PGP Unpackage service.
- Create a PGP profile, using the PGP Server Manager.
- Create a PGP Unpackage service configuration.
- Configure the PGP Unpackage service.
- Use the PGP Unpackage service in a business process.
Configure the PGP Unpackage Service
- If the secret_keymap_name and conv_keymap_name parameters are not present, the PGP Unpackage service will verify the signature of the document only.
- If one of the keymap_name parameters is present, it will use the information of the keymap_name to decrypt.
- If there is a signature in the document, the verification of the signature will be done automatically.
To configure the PGP Unpackage service, specify the settings for the fields in the GPM. These fields are described in the subsequent table.
Field | Description |
---|---|
Config | Name of the service configuration. |
workingDir | The working directory where files for decryption or verification will be read from or written to. You must set this parameter in this field or in the associated Command Line 2 adapter configuration. |
remoteName | Remote name or IP address where the remote adapter implementation is running. Optional if the cmdline2svcname field is defined in the Command Line 2 adapter. You must set this parameter in this field or in the associated Command Line 2 adapter configuration. |
remotePort | Remote port that the remote adapter implementation is listening on. Optional if the cmdline2svcname field is defined in the Command Line 2 adapter. You must set this parameter in this field or in the associated Command Line 2 adapter configuration. |
profile_name | The name of PGP profile. Required. |
secret_keymap_name | Key name defined in the secret key ring in the PGP profile. Required for decryption (public key cryptography). |
conv_keymap_name | Key name defined in the public key ring in the PGP profile. Required for decryption (conventional cryptography). |
DocumentId | The document identifier for the document to be processed. The default document for processing is the primary document. Optional. |
cmdline2svcname | If not using the default configuration of the Command Line 2 adapter (PGPCmdlineService), enter the name of the configuration to be used. Optional. |
outputfilename | Output file name. For E-Business Server, outputfilename must have an extension of
.asc or .pgp. If a different extension is used, outputfilename will be appended with .asc. For all
versions, if outputfilename is not specified, the file name is retrieved from the name of the
primary document or the body name of a document and is appended with the following:
|
pgp_partner_name | The partner name used in encryption and signing. If specified, the business process uses the parameters you specify in the selected partner profile. Required if you specify a value in the pgp_sponsor_name parameter. The values you specify in the GPM override the values you specify in the profile. |
pgp_sponsor_name | The sponsor name used in encryption and signing. If specified, the business process uses the parameters you specify in the selected sponsor profile. Required if you specify a value in the pgp_partner_name parameter. The values you specify in the GPM override the values you specify in the profile. |
tmpDir | The directory location for temporary scratch files. If not specified, the temporary files are written in the current working directory. If the shell environmental variable TMP is defined, PGP stores temporary files in the named directory. Optional. |
info | How much information is returned. Valid values
are:
|
The following table contains the parameters that are passed from the PGP Unpackage service to the business process:
Parameter | Description |
Action (PGP/Action) | Action of this PGP execution. Valid values are DECRYPT and VERIFY. Required. |
FileName (PGP/FileName) | The name of the file which is being processed. Required. |
DocumentPGP/Document() | The processed document is placed in Process Data – not as Primary Document. The attribute is the SCIObjectID, which allows the user to click on it for viewing the content of the processed document. Required. |
DocumentId (PGP/DocumentId) | The document identifier of the document. Required. |
Status (PGP/Status) | The status shows if this process has completed successfully or failed. Valid values are Success and Error. Required. |
ErrorCodePGP/ErrorCode() | This is the exit value returned from executing PGP commands. This will be shown when the Status is ‘Error'. Optional. |
ErrorDescription (PGP/ ErrorDescription) | This is the error description based on the ErrorCode. This will be shown when the Status is ‘Error'. Optional. |
Business Process Example - Decrypt Operation (Public Key Decryption)
The following business process uses the PGP Unpackage service to decrypt the primary document in the document area. The profile is based on PGP107. In this case, the default Command Line 2 adapter configuration, PGPCmdlineService, is used to execute the decrypt command. It uses the working directory, remote name and port stated in the business process. Therefore, these values will override any pre-configured values in PGPCmdlineService.
<process name="PGP_Decrypt ">
<sequence name="optional">
<operation name="One">
<participant name=" PGPUnpackageService "/>
<output message="Xout">
<assign to="." from="*"></assign>
<assign to="profile_name">PGP107</assign>
<assign to=" secret_keymap_name"> my_secret </assign>
<assign to="workingDir">/server1/tmp</assign>
<assign to="remoteName">00.000.00.000</assign>
<assign to="remotePort">12345</assign>
</output>
<input message="Xin">
<assign to="." from="*"></assign>
</input>
</operation>
</sequence>
</process>
Business Process Example - Verify Operation
The following business process uses the PGP Unpackage service to verify the primary document in the document area. The profile is based on PGP107. In this case, the Command Line 2 adapter configuration called MyCLA2 is used to execute the commands. The remote name, port and working directory have been pre-configured in the service configuration. Therefore, they are not required in the business process.
<process name="PGP_Verify">
<sequence name="optional">
<operation name="One">
<participant name="PGPUnpackageService "/>
<output message="Xout">
<assign to="." from="*"></assign>
<assign to="profile_name">PGP107</assign>
<assign to="cmdline2svcname">MyCLA2</assign>
</output>
<input message="Xin">
<assign to="." from="*"></assign>
</input>
</operation>
</sequence>
</process>
Business Process Example - OnFault Handling
The following business process shows onFault handling with the PGP Unpackage service.
<process name="PGP_Decrypt">
<sequence name="optional">
<operation name="One">
<participant name="PGPUnpackageService "/>
<output message="Xout">
<assign to="." from="*"></assign>
<assign to="profile_name">PGP107</assign>
<assign to=" secret_keymap_name"> si_secret </assign>
<assign to="workingDir">/server1/tmp</assign>
<assign to="remoteName">00.000.00.000</assign>
<assign to="remotePort">12345</assign>
</output>
<input message="Xin">
<assign to="." from="*"></assign>
</input>
</operation>
<assign to="Status">The file is decrypted successfully</assign>
<onFault>
<assign to="Status">General Error Occurred</assign>
</onFault>
<onFault code="[PGPErrorCode] Decryption error">
<assign to="Status">Decryption error</assign>
</onFault>
</sequence>
</process>
Business Process Example - PGP Partner and PGP Sponsor
The following business process uses the PGP Partner and PGP Sponsor services to decrypt and verify documents.
<process name="use_partner_sponsor">
<operation name="PGP Unpackage Service">
<participant name="PGPUnpackageService"/>
<output message="PGPUnPackageServiceTypeInputMessage">
<assign to="pgp_partner_name">partner</assign>
<assign to="pgp_sponsor_name">sponsor</assign>
<assign to="profile_name">pgp</assign>
<assign to="." from="*"></assign>
</output>
<input message="inmsg">
<assign to="." from="*"></assign>
</input>
</operation>
</process>
Advanced Status Messages
Exit Codes from E-Business Server
The following table contains exit codes from E-Business Server. The content of the description field will be displayed in the Advanced Status column, preceded by [PGPErrorCode]:
Status | Description |
---|---|
0 | Exit OK, no error |
1 | Invalid file |
2 | File not found |
3 | Unknown file |
4 | Batch mode error |
5 | Bad argument |
6 | Process Interrupted |
7 | Out of memory error |
8 | Environment error |
20 | Signature error |
21 | Public Key Encryption error |
22 | Encryption error |
23 | Compression error |
30 | Signature Check error |
31 | Public Key Decryption error |
32 | Decryption error |
33 | Decompression error |
34 | Keyring locked error |
101 | File parsing error |
Exit Codes from PGP Command Line
The following table contains exit codes from PGP Command Line. The content of the description field will be displayed in the Advanced Status column, preceded by [PGPErrorCode]:
Status | Description |
---|---|
0 | PGP Command Line exited successfully. |
64 | Parser error. |
71 | Bad data was received from the operating system at startup. |
128 | An internal error occurred. |
129 | An initialization failure occurred on startup. |
130 | A user interrupt occurred. |
145 | Error purging a cache: passphrase, keyring, or both. |
146 | Error creating keyring files. |
147 | Error during a speed test operation. |
160 | Complete failure during a file wipe. |
161 | Partial fail, partial success during a file wipe (one file wiped, one not, for example). |
162 | Complete failure during an encode. |
163 | Partial failure during an encode. |
164 | Complete failure during a decode. |
165 | Partial failure during a decode. |
210 | Error during one of the key list operations. |
220 | Error during key maintenance. |
221 | Error when checking signatures. |
222 | Error when checking user IDs. |
230 | Error during one of the key edit operations. |
240 | Error during one of the key server operations. |
245 | Error with supplied license. |
251 | License is expired. |
255 | An unknown error occurred. |
Errors During Validation
The following table contains errors that result from the PGP Unpackage service when it validates information before executing PGP commands on the remote server. The content of the status field will be displayed in the Advanced Status column:
Status | Description |
---|---|
Error in accessing the document with a given DocumentId | The DocumentId value given in the bpml is incorrect. |
Fail to get data from Primary Document | There is no Primary Document. Primary Document is mandatory. |
You must enter one of these BPML Params: 'public_user' or 'secret_keymap_name' or 'conv_keymap_name' | Either one of the BPML Parameters must be present for PGP to encrypt, sign or encrypt and sign. |
Incorrect Profile Name in BPML Param: 'profile_name'. It is not found in the PGP Server Manager | The profile_name value given in the bpml is incorrect. |
Incorrect Key Name (BPML Param: 'secret_keymap_name'). It is not found in the PGP Profile's Secret KeyMap | The secret_keymap_name value given in the bpml is incorrect. |
Incorrect Key Name (BPML Param: 'conv_keymap_name'). It is not found in the PGP Profile's Conventional KeyMap | The conv_keymap_name value given in the bpml is incorrect. |