Edit

Users and permissions

Create the following users on the corresponding server before the installation.

Linux servers

• Linux installation user (for example, ec2-user).

  This temporary user is only required during installation and can be either a local Linux user or an LDAP user (for example, from ActiveDirectory). Installed IA Cloud services run under an unprivileged runtime user (see further). After installation, you can revoke the sudo privileges, if needed.

  Linux installation user must:

  • exist on each Linux server.
  • have SSH access via the SSH-key from the APP server to all other Linux servers.
  • have the sudo permissions on all Linux servers. The following privileged operations are required for this user: /usr/bin/sh, /usr/bin/su, /bin/bash, /usr/bin/mkdir, /usr/bin/chmod, /usr/bin/chown.

warning

if you want to install IA Cloud Enterprise most quickly, you will need SSH access and sudo permissions.

If your company's policies can't provide you with these requirements, the user with the root privileges must perform all the required operations manually. In this case, the installation takes longer.

• Linux runtime user (for example, <wf_user>).

  An unprivileged user for running the IA Cloud services must exist on each Linux server.

  • It can be either a local Linux user or an LDAP user (for example, from ActiveDirectory).
  • Linux runtime user and the group it belongs to (<wf_group>) must be the same for all Linux servers (including UID and GID).
  • Linux runtime user (<wf_user>) and group (<wf_group>) must not contain any whitespace characters in the name.

important

Linux installation and runtime users with the backslash symbol ("\") in the username are not supported. If you are using AD users, change the format of the login username from DOMAIN\USER to USER@DOMAIN.

Windows servers

• BI installation user (<bi_user>) must exist on the BI (Analytics) servers with the Administrator privileges. The user's credentials must be the same on all BI servers.

  The following password policies are applied for the BI installation user:

  • Allowed symbols: #*@/+-=_$}{][:,)(.;!?
  • Forbidden symbols: ^'|`<>"&%

• RPA installation user (<rpa_user>) must exist on RPA servers with Administrator privileges. The user's credentials must be the same on all RPA servers.

• OCRWin installation user (<ocrwin_user>) must exist on OCR windows servers with Administrator privileges (if you have chosen Windows as the OCR Platform). The user's credentials must be the same on all OCR servers (if several).

• All usernames on Windows servers must not contain any whitespace characters.

Other requirements

• WinRM (over HTTPS with CredSSP authentication) must be available from the APP server to all Windows servers for respective Windows installation users.
• Domain and local policies provide Administrator permissions for at least 60 minutes.
• Time must be synchronized on all servers.

How to create users

On the installation server

To create an installation user on the server, from which you are going to install the system (APP or INT):

1. Connect to the APP server as a user with the sudo privileges:

   $ ssh -i <path-to-private-key.pem> <root>@<hostname.example.com>
   

2. Create a Linux installation user:

   $ sudo useradd -m <username>
   

   Here, <username> is the login name of the Linux installation user. The user's name must be written in lowercase letters.

3. Provide the sudo privileges for the Linux installation user. For that:

   1. Make sure that the line #includedir /etc/sudoers.d exists in the sudoers file.

      $ sudo cat /etc/sudoers | grep includedir
      #includedir /etc/sudoers.d
      

   2. Run the command:

      $ sudo visudo -f /etc/sudoers.d/<username>
      

   3. In the end of the sudoers file, add the following line:

      <username> ALL=(ALL) NOPASSWD:/usr/bin/sh,/usr/bin/su,/bin/bash,/usr/bin/mkdir,/usr/bin/chmod,/usr/bin/chown
      

   Save and close the file.

4. Switch to the Linux installation user:

   $ sudo su - <username>
   

5. Generate the SSH pair key for the installation:

   $ ssh-keygen -t rsa -C 'inventory@workfusion.com' -f ~/.ssh/ansible_ssh_key -N ''
   

   If using a private password-protected SSH key, enter the passphrase when prompted during the installation.

6. Open the generated public key and save it to clipboard:

   $ cat ~/.ssh/ansible_ssh_key.pub
   

After the above operation, proceed to other Linux and Windows servers to create the same user there. For the instructions, see the further sections.

warning

• If you plan to set up Enterprise Edition in the HA mode, remember to add the same user on other APP server instances.

On other Linux servers

The same users must be present on all Linux servers, including those that are used for load balancing, if you decide to install Enterprise Edition in the HA mode.

To create an installation user on other Linux servers:

1. Connect to a Linux server as a user with the sudo privileges:

   $ ssh -i <path-to-private-key.pem> <root>@<vdsmaster1.workfusion.com>
   

2. Create a Linux installation user:

   $ sudo useradd -m <username>
   

   The user's name must be the same as on the APP server and be written in lowercase letters.

3. Provide the no-password sudo privileges for the Linux installation user. For that:

   1. Make sure that the line #includedir /etc/sudoers.d exists in the sudoers file.

      $ sudo cat /etc/sudoers | grep includedir
      #includedir /etc/sudoers.d
      

   2. Run the command:

      $ sudo visudo -f /etc/sudoers.d/<username>
      

   3. In the end of the sudoers file, add the following line:

      <username> ALL=(ALL) NOPASSWD:/usr/bin/sh,/usr/bin/su,/bin/bash,/usr/bin/mkdir,/usr/bin/chmod,/usr/bin/chown
      

   Save and close the file.

4. Create the folder for the SSH keys and change its permissions:

   $ sudo mkdir /home/<username>/.ssh/
   
   $ sudo chmod 700 /home/<username>/.ssh/
   

5. In the new directory, create the SSH key file authorized_keys and paste the copied public key from the APP server to it:

   $ sudo vi /home/<username>/.ssh/authorized_keys
   

6. Change permissions and the owner of the directory:

   $ sudo chown -R <username>:<username> /home/<username>/.ssh
   $ sudo chmod 600 /home/<username>/.ssh/authorized_keys
   

7. Make sure that SSH key-based authentication is enabled on all Linux servers. In this case, file /etc/ssh/sshd_config on these servers must contain the following line:

   PubkeyAuthentication yes
   

   If you use SSH password-based authentication instead, file /etc/ssh/sshd_config on all Linux servers must contain the following line:

   PasswordAuthentication yes
   

To check that you have done everything right, make the SSH connection from the APP server to the current server as a Linux installation user:

[<username>@<app-server> ~]$ ssh -i ~/.ssh/ansible_ssh_key <username>@<current_server_host>

On Windows servers

To create an installation user on the Windows server:

1. Download Remote Desktop or any other software for connecting to Windows servers.

2. Open the software and specify:

   • the server's name
   • the user's name
   • the user's password

3. Connect to the remote Windows server as a user with the administrator's privileges.

4. Run PowerShell as Administrator.

5. In PowerShell, run the following commands:

   $ net user <username> <passwd> /add
   $ net localgroup administrators <username> /add
   

   Here,<username> is the name of the Windows installation user, and <passwd> is the password for the Windows installation user.

For future maintenance, make sure that the Windows user is active, has all required administrator permissions, and the password is not expired.

Checklist

To facilitate preparation for the IA Cloud setup, after you create the users on servers, complete the checklist, and provide it to the WorkFusion deployment engineers.

Click the link to download the archive with all checklists.