Generating RSA Keys for SFTP Authentication in OneTrust Integrations

OneTrust Integrations supports SFTP authentication only with RSA private keys in PKCS8 format. Before you create or update an SFTP credential, make sure your private key uses this format. If needed, you can convert an existing key before uploading it to OneTrust.

Note:

For information about rotating key pairs, see Rotating Key Pairs for Integration Credentials.



Generate Key Pair

  1. Open a Command Prompt.

  2. Enter the command ssh-keygen -t rsa-sha2-256 -b 2048

    Note:

    These steps use "ssh-keygen" as the tool of choice. Other utilities may be used to the same ends.

  3. Specify the file and file path to save the key. The default may be used if desired.

  4. Enter a passphrase if desired (this can be supplied during credential setup in OneTrust).

  5. Confirm the passphrase.

  6. Note the location of your Public and Private Key Pairs, as well as the key fingerprint and random art image:

    CODE 
    #Example Command Prompt Keystrokes and Logs

C:\Users\ChuckBradshaw>ssh-keygen -t rsa-sha2-256 -b 2048
Generating public/private rsa-sha2-256 key pair.
Enter file in which to save the key (C:\Users\ChuckBradshaw/.ssh/id_rsa):
C:\Users\ChuckBradshaw/.ssh/id_rsa already exists
Overwrite (y/n)? Y
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in C:\Users\ChuckBradshaw/.ssh/id_rsa.
Your public key has been saved in C:\Users\ChuckBradshaw/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:Rcl0BZ/E81wx1hzeufmMncbGseiscVEQp2SW2mfvaQI azuread\chuckbradshaw@onetrust.com
The key's randomart image is:
+---[RSA 3072]----+
| .+.**@=|
| .. =oB+O|
| . o. **|
| . . ..o=|
| S .o+.|
| E =+*|
| ..o.O=|
| =.oo.|
| o.oo |
+----[SHA256]-----+

Upload Private Key into OneTrust

  1. On the Integrations menu, select Credentials. The Credentials screen appears.

  2. Click the Add credential button. The Create credentials screen appears.

  3. Type in the Select System field to look up your desired system. You can also choose Generic to proceed without a system preference.



  4. Click the Next button. The Enter Credential Details screen appears.

  5. Supply a name and description, then choose File Share as the Application type to populate the necessary credential fields for SFTP.

  6. Complete the required fields with your SFTP server information then click the Save button.



    Field

    Details

    Authentication Method

    Defaults to SFTP.

    Protocol

    Defaults to SFTP.

    Hostname

    Enter the hostname. This will default to the access token URL.

    Port

    Enter the server's Port number.

    User Name

    Enter your username.

    Authentication Type

    Choose from the following:

    • Private Key

    • Password

    • Password and Private Key

    Private Key

    Enter your RSA Private Key, with a header and footer similar to:

    CODE 
    -----BEGIN RSA PRIVATE KEY-----

-----END RSA PRIVATE KEY-----

    Passphrase

    Provide if an optional passphase is used with the key.

Upload Public Key to SFTP Server

This will vary based your chosen SFTP server administrative console.

Test Connection with SFTP Server

  1. Create a workflow connection using the Scheduler trigger option.



  2. Add a Directory from FTP action.



  3. Select an existing SFTP credential.



  4. Set up the folder path in the Request tab.



  5. Click the Save button for the workflow.

  6. Click the Context Menu icon to select Test Workflow. A new pane will appear.



  7. Click the Test button. A successful authentication attempt will list the directories contents and return a "200 OK" response code.