Edit

Change runtime user

This article describes how to change a user to run the installed IA Cloud Enterprise.

Prepare servers

Before changing a user, prepare the servers.

As current user

To prepare servers:

1. Run the following commands as the current APPLICATION_USER, for example, WFUSER:

   • For single-point installation: log in to the APP server, and stop all services, except BI, by running ./install.sh stop_services full -e skip_bi=true.

   • For multi-point installation:

     1. On each Linux server, run the following command:

        wfmanager stop all
        

     2. Connect to the RPA server via RDP and stop the WFSvc service.

2. On each Linux server, as the root user stop supervisord:

   systemctl stop supervisord
   

3. On each Linux server, as the root user check that no processes are running from INSTALL_DIR. If there are active processes, stop them:

   ps -ef | grep /opt/workfusion
   kill -9 <PID>
   

Reconfigure services

Root user operations

To reconfigure services for the new user, perform the following operations as the root user on each Linux server:

1. Create a new runtime user and group if you don't have any:

   groupadd {{ new_user }}
   useradd -m -g {{ new_user }} {{ new_group }}
   

2. Change supervisor service parameters:

   vi /etc/systemd/system/supervisord.service:
   

   ...
   User={{ new_user }}
   Group={{ new_group }}
   ...
   

3. Change the owner of /opt/workfusion (PACKAGE_DIR) to {{ new_user }}:{{ new_group }}:

   chown -R {{ new_user }}:{{ new_group }} /opt/workfusion
   

4. On the APP server, grant the HAProxy permissions to run on privileged ports:

   /usr/sbin/setcap CAP_NET_BIND_SERVICE=+eip /opt/workfusion/haproxy/bin/haproxy
   

5. Reload daemons:

   systemctl daemon-reload
   

6. Start supervisord:

   systemctl start supervisord
   

New user operations

Perform the following operations as the new user:

1. On the APP (or INT for HA) server, update Zookeeper settings for AutoML model and Worker management services:

   cd /opt/workfusion/zookeeper/bin
   ./zkCli.sh
   set /config/automl-model-service/automl.service.model.cluster.username {{ new_user }}
   set /config/worker-management-service/bep.wms.worker.execute.user {{ new_user }}
   

2. Restart worker-management-service and automl-model-service:

   source /opt/workfusion/environment.sh
   wfmanager restart worker-management-service
   wfmanager restart automl-model-service
   

3. Update config.yml:

   ./install.sh edit_config app
   

   ...
   wf_user: {{ new_user }}
   wf_group: {{ new_group }}
   ...
   

4. Start the RPA service:

   • For single-point installation:

     ./install.sh start_services rpa
     

   • For multi-point installation: log in to the RPA server via RDP and start the WFSvc service.

Check changes

To validate that the product is running as expected after the user change, run the following command:

./install.sh check full -e test_ml=true -e test_ocr=true -e test_rpa=true -e test_ie=true -e test_desktop=true

Distribute SSH configuration

For the ease of future system maintenance with the new user, we recommend distributing the SSH configuration:

1. On the APP server, do the following:

   1. Generate the SSH key pair for the new user:

      sudo su - {{ new_user }}
      ssh-keygen -t rsa -C 'inventory@workfusion.com' -f ~/.ssh/ansible_ssh_key -N ''
      

   2. Open the generated public key and save it to the clipboard:

      cat ~/.ssh/ansible_ssh_key.pub
      

2. On the other Linux servers:

   1. Create a directory for SSH keys and change its permissions:

      sudo su - {{ new_user }}
      mkdir ~/.ssh/
      chmod 700 ~/.ssh
      

   2. In the new directory, create the SSH key file authorized_keys and paste the copied public key from the APP server. Change permissions for the file:

      vi ~/.ssh/authorized_keys
      chmod 600 ~/.ssh/authorized_keys