10.1.4.1

Edit

Configure Secrets Vault

Secrets Vault use cases

Secrets Vault addresses the following major use cases.

Store passwords of legacy applications

Scope: passwords that are used by Automation.

Applications: legacy applications without integrated password management.

Benefits: an ability to securely store sensitive third-party and external passwords.

Out of the box: by default, WorkFusion uses Secrets Vault as a storage backend for such passwords.

Integration: Alternatively the passwords can be retrieved from the established Password Management software (CyberArk AIM, Dell TPAM, and so on). In such cases, the passwords are retrieved in the automation logic through API.

See also:

Store internal Intelligent Automation Cloud passwords

Scope: passwords that are used by an Intelligent Automation Cloud component or a module to connect to another component.

Benefits: elimination of plain text passwords from configuration files.

Out of the box: WorkFusion stores such passwords in bundled Secrets Vault.

Examples:

  • Database password used by Control Tower
  • OCR password used by Control Tower

Platform configuration properties

Secure: The properties that contain sensitive information and stored in Secrets Vault.

Non-secure: The set of properties is not secure and can be defined or changed on the INT server, in the INSTALL_DIR/wf-sec-storage/ directory in the following files (if you have the OCR server installed on the same server):

  • ocr-rest-secure.properties
  • ocr-worker-secure.properties

Control Tower secure properties

The following properties must be configured by a separate method. If you apply the properties with an empty value, they are erased from the system.

s3.access-key
s3.secret-key
s3.context.key.map
s3.context.key.map.presign
jwt.secret
bot.manager.jwt.secret
jwt.issuer
ldap.server.url
ldap.bind.dn
ldap.bind.password
wf.sso.saml.metadata.admin.username
wf.sso.saml.metadata.admin.password
wf.sso.saml.metadata.admin.authorities
wf.sso.saml.idp.metadata
wf.sso.saml.idp.file.metadata
wf.sso.saml.sp.metadata
wf.sso.saml.username.attribute
tableau.automation.host
tableau.automation.username
tableau.automation.password
tableau.dashboard.host
tableau.dashboard.username
tableau.dashboard.password
automl.services.endpoint
automl.services.username
automl.services.password
automation.application.url
automation.username
automation.password
nexus.url
nexus.user
nexus.password
mail.username
mail.password
workfusion.accessKey
workfusion.secretKey
hazelcast.group.name
hazelcast.group.password
twilio.account.sid
twilio.auth.token
twilio.application.sid

ct.datasource.url
ct.datasource.username
ct.datasource.password

ds.datasource.url
ds.datasource.username
ds.datasource.password

spring.rabbitmq.host
spring.rabbitmq.port
spring.rabbitmq.virtual-host
spring.rabbitmq.username
spring.rabbitmq.password

WorkSpace secure properties

The following properties are stored separately and required to configure WorkSpace:

ws.datasource.username
ws.datasource.password
ws.secure.jwt.secret
ws.secure.ldap.server.url
ws.secure.ldap.bind.dn  
ws.secure.ldap.bind.password
ws.sso.saml.idp.metadata
ws.sso.saml.idp.file.metadata
ws.sso.saml.username.attribute  
ws.sso.saml.sp.metadata
ws.mail.username
ws.mail.password

OCR secure properties

The following properties are stored separately in ocr-rest-secure.properties and ocr-worker-secure.properties, and are required for the OCR configuration.

The following properties are the same for Windows and Linux OCR.

ocr-rest-secure.properties

jwt.secret
ocr.task.sn
ocr.task.engine.license.password
ocr.task12.sn
ocr.task12.engine.license.password
spring.security.username
spring.security.password
spring.rabbitmq.username
spring.rabbitmq.password
spring.datasource.username
spring.datasource.password

ocr-worker-secure.properties

spring.rabbitmq.username
spring.rabbitmq.password
spring.datasource.username
spring.datasource.password

View secrets

To view all passwords used in IA Cloud:

  1. Log in to the INT server via SSH.

  2. Switch to <WF_USER>.

    su - wfuser

  3. Go to the INSTALL_DIR directory.

    cd /opt/workfusion/wf-sec-storage/

  4. Run the following command:

    ./loader.sh ansible review

    Output example 

    [INFO ] You are working with safe : workfusion_ansible_secrets
[INFO ] Properties from secure storage

[INFO ] Key : Value
[INFO ] ansible_vault_password : secret_value
[INFO ] bot_manager_jwt_secret : secret_value
[INFO ] bot_relay_user_name : secret_value
[INFO ] bot_relay_user_pass : secret_value
[INFO ] bot_user_base_name : secret_value
[INFO ] bot_user_pass : secret_value
[INFO ] ca_key_pass : secret_value
[INFO ] rpa_bots_per_server : secret_value
[INFO ] elk_admin_password : secret_value
[INFO ] elk_elastic_password : secret_value
[INFO ] elk_kibana_certificate_pass : secret_value
[INFO ] elk_kibana_password : secret_value
[INFO ] elk_logstash_certificate_pass : secret_value
[INFO ] elk_logstash_password : secret_value
[INFO ] hazelcast_port : secret_value
[INFO ] install_dir : secret_value
[INFO ] internet_access : secret_value
[INFO ] ldap_bind_dn : secret_value
[INFO ] ldap_bind_password : secret_value
[INFO ] ldap_enabled : secret_value
[INFO ] ldap_group_base : secret_value
[INFO ] ldap_group_filter : secret_value
[INFO ] ldap_internal_authorization_enabled : secret_value
[INFO ] ldap_server_url : secret_value
[INFO ] ldap_user_base : secret_value
[INFO ] ldap_user_filter : secret_value
[INFO ] linux_installation_user : secret_value
[INFO ] log_level_type : secret_value
[INFO ] mail_host : secret_value
[INFO ] mail_pass : secret_value
[INFO ] mail_port : secret_value
[INFO ] mail_sender : secret_value
[INFO ] mail_user : secret_value
[INFO ] marathon_proxy_port : secret_value
[INFO ] marathon_web_password : secret_value
[INFO ] mesos_master_port : secret_value
[INFO ] mesos_slave_port : secret_value
[INFO ] mesos_slave_port_range : secret_value
[INFO ] mesos_web_password : secret_value
[INFO ] mssql_ct_pass : secret_value
[INFO ] mssql_ct_user : secret_value
[INFO ] mssql_dba_pass : secret_value
[INFO ] mssql_dba_user : secret_value
[INFO ] mssql_dm_api_pass : secret_value
[INFO ] mssql_dm_api_user : secret_value
[INFO ] mssql_dm_pass : secret_value
[INFO ] mssql_dm_user : secret_value
[INFO ] mssql_ds_pass : secret_value
[INFO ] mssql_ds_user : secret_value
[INFO ] mssql_external : secret_value
[INFO ] mssql_ocr_pass : secret_value
[INFO ] mssql_ocr_user : secret_value
[INFO ] mssql_pm_pass : secret_value
[INFO ] mssql_pm_user : secret_value
[INFO ] mssql_port : secret_value
[INFO ] mssql_rapi_pass : secret_value
[INFO ] mssql_rapi_user : secret_value
[INFO ] mssql_rpa_pass : secret_value
[INFO ] mssql_rpa_user : secret_value
[INFO ] mssql_sa_pass : secret_value
[INFO ] mssql_sqc_pass : secret_value
[INFO ] mssql_sqc_user : secret_value
[INFO ] mssql_ws_pass : secret_value
[INFO ] mssql_ws_user : secret_value
[INFO ] nexus_admin_pass : secret_value
[INFO ] nexus_api_pass : secret_value
[INFO ] nexus_deployment_pass : secret_value
[INFO ] nginx_port : secret_value
[INFO ] nginx_port_ssl : secret_value
[INFO ] ocr_jwt_secret : secret_value
[INFO ] ocr_platform : secret_value
[INFO ] ocr_sec_pass : secret_value
[INFO ] rabbitmq_api_proxy_port : secret_value
[INFO ] rabbitmq_bep_pass : secret_value
[INFO ] rabbitmq_ocr_pass : secret_value
[INFO ] rabbitmq_vds_pass : secret_value
[INFO ] rpa_bot_agent_pass : secret_value
[INFO ] rpa_bot_manager_pass : secret_value
[INFO ] s3_access_key : secret_value
[INFO ] s3_secret_key : secret_value
[INFO ] sso_saml_enabled : secret_value
[INFO ] sso_saml_idp_file_metadata : secret_value
[INFO ] sso_saml_idp_metadata : secret_value
[INFO ] sso_saml_sp_metadata : secret_value
[INFO ] sso_saml_username_attribute : secret_value
[INFO ] tableau_automation_pass : secret_value
[INFO ] tableau_dashboard_pass : secret_value
[INFO ] tableau_license_key : secret_value
[INFO ] vault_admin_cert_pass : secret_value
[INFO ] vault_port : secret_value
[INFO ] vault_workfusion_cert_pass : secret_value
[INFO ] wf_group : secret_value
[INFO ] wf_password : secret_value
[INFO ] wf_user : secret_value
[INFO ] wf_username : secret_value
[INFO ] win_install_dir : secret_value
[INFO ] windows_installation_pass : secret_value
[INFO ] windows_installation_user : secret_value
[INFO ] workspace_license_access_key : secret_value
[INFO ] workspace_license_secret_key : secret_value
[INFO ] workspace_root_requester_pass : secret_value
[INFO ] ws_enable_worker_email_confirmation : secret_value
[INFO ] ws_ldap_requester_groups : secret_value
[INFO ] ws_ldap_worker_groups : secret_value
[INFO ] zookeeper_port : secret_value
[INFO ] It's all

Configure Secrets Vault on production environment

When deploying the Product to the Production environment, you must mandatorily configure Secrets Vault entries.

However, if developers are allowed to do that on production servers, they can violate security policies by reading other departments' Secrets Vault entries.

To avoid that, use any of the following rules:

  • Restrict developers from accessing the production servers.
  • Restrict developers to view Secret Vault by assigning permissions and appropriate roles. For more information, see Role management.
  • Add user-assigned filters, so that a developer can only view Secret Vault entries with a specific prefix. For more information, see Filters for Collaborative Work.
  • Change the code review process to ensure that Secure Vault entries are not displayed in logs, stored in Data Stores, or placed to the RPA system in plain text.
← Manage secure propertiesNext →