8.5

Edit

APP Server post-installation procedures

RPA Manager on APP Server

After RPA Hub installation, RPA manager should be manually configured. Default configuration of RPA manager depends on https_enabled in config.yml:

  • https_enabled = true, RPA manager is configured in SSL mode.
  • https_enabled = false, RPA manager is configured in non-SSL mode. You still need to proceed this post-installation procedures.

During configuration select one option and follow up the instruction for that, do not mix steps for different solutions.

Solution 1. Configuration of RPA Manager in non-SSL mode

The solution describes how to set up a non-SSL configuration between RPA manager and RPA Hub.

  1. Verify that use.ssl and use.ssl.client.authorization are set to false in the RPA Manager configuration file on APP server: {INSTALL_DIR}/rpa_manager/grid-router/application.properties.

    use.ssl=false
use.ssl.client.authorization = false

  2. Verify that the NAME variable is properly defined (see the RPA Hub configuration) for each RPA Hub in the user.xml configuration file on APP server:

    #link: manager_quota 

{INSTALL_DIR}/rpa_manager/grid-router/quota/user.xml. 
#By default it is rpa-hub.example.com

    ...
<host name="rpa-hub.example.com" port="4444" count="2"/>
...

  3. Verify that the PORT variable is properly defined (see the RPA Hub configuration) for each RPA Hub in the user.xml configuration file on APP server:

    #link: manager_quota 

{INSTALL_DIR}/rpa_manager/grid-router/quota/user.xml. 
#By default it should be 4444 for non-SSL mode.

    ...
<host name="rpa-hub.example.com" port="4444" count="2"/>
...

  4. Once any changes are made in the RPA Manager configuration files, restart the service:

    wfmanager restart rpa-manager

Solution 2 and 3. Configuration of RPA Manager in SSL mode

This section provide a brief description how to setup the two way authentication between RPA Manager and RPA Hub. Select one option and follow up the instruction for that, do not mix steps for different solutions.

There are two possibilities to configure TLS client authentication:using self-signed certificates,using existing certificates.

Solution 2. Сonfigure TLS client authentication with self-signed certificates

If RPA Manager and RPA Hub use TLS authentication with self-signed certificates for communications, we should generate cleint.jks and server.jks.

  1. Generate keys and self-signed certificates

    1. Obtain the shell access to APP Server where RPA Manager is installed. Check if automatically generated certificates in /rpa_manager/ssl are adequate to hubs DOMAIN names. If it's required to generate wildcard certificates, proceed to the next steps.

    2. Go to the /rpa_manager directory.

    3. Generate the certificates pair. Run this script to generate the certificates pair, put them to the /rpa_manager/ssl directory and add them to cleint.jks and server.jks.

    cd <INSTALL_DIR>/rpa-manager/
mkdir ssl
./rpa.sh -g <RPAHUB_SERVER_DNS>
    1. Repeate these steps for each RPA Hub installed.
    note

    It's possible to generate SSL certificates using wildcards. In Example 2 below, the asterisk character (*) allows using the certificates for any subdomain of example.com on a few RPA Hub servers. Alternatively, you should run rpa.sh for each RPA Hub installed.

    Possible usage:

    cd <INSTALL_DIR>/rpa-manager/
mkdir ssl
# Example 1
./rpa.sh -g rpahub01.example.com
# Example 2
./rpa.sh -g *.example.com

    Example 1 output:

    ls -1 <INSTALL_DIR>/rpa-manager/ssl

./client-public-rpa1.example.com.cer   
./client-rpa1.example.com.p12      # P12 cert: may be imported to web-browser
./client-rpa1.example.com.pem      # Client certificate
./server-public-rpa1.example.com.cer
./server-rpa1.example.com.key      # Server key file
./server-rpa1.example.com.p12
./server-rpa1.example.com.pem      # Server certificate

  2. Configure application.properties.

    1. Ensure that use.ssl is set to true in the RPA Manager configuration file on APP server: <INSTALL_DIR>/rpa_manager/grid-router/application.properties.
    use.ssl=true
    1. Ensure, that use.ssl.client.authorization is set to true in the RPA Manager configuration file on APP server: <INSTALL_DIR>/rpa_manager/grid-router/application.properties.
    use.ssl.client.authorization=true

  3. Configure RPA Hub quota.

    1. Modify the user.xml file on APP server: /rpa_manager/grid-router/quota/user.xml
    2. Put the correct values for hostname, port, and count properties in <host name="[rpa-hub.example.com](http://rpa-hub.example.com)" port="443" count="2"/>.

    Example:

    <qa:browsers xmlns:qa="urn:config.gridrouter.qatools.ru">
    <browser name="chrome" defaultVersion="1.0">
        <version number="1.0">
            <region name="hub1">
                <host name="rpa-hub.example.com" port="443" count="2"/>
            </region>
        </version>
    </browser>
    <browser name="internet explorer" defaultVersion="11">
        <version number="11">
            <region name="hub1">
                <host name="rpa-hub.example.com" port="443" count="2"/>
            </region>
        </version>
    </browser>
    <browser name="desktop" defaultVersion="1.0">
        <version number="1.0">
            <region name="hub1">
                <host name="rpa-hub.example.com" port="443" count="2"/>
            </region>
        </version>
    </browser>
    <browser name="universal" defaultVersion="1.0">
        <version number="1.0">
            <region name="hub1">
                <host name="rpa-hub.example.com" port="443" count="2"/>
            </region>
        </version>
    </browser>
</qa:browsers>

  4. Restart the RPA manager service on APP Server.

    wfmanager restart rpa-manager

  5. Transfer the following certificates to RPA Hub (Windows Server) and proceed with configuring nginx with SSL on RPA Hub.

    Example 1 output:

    <INSTALL_DIR>/rpa-manager/ssl/client-rpa1.example.com.pem      # Client certificate
<INSTALL_DIR>/rpa-manager/ssl/server-rpa1.example.com.key      # Server key file
<INSTALL_DIR>/rpa-manager/ssl/server-rpa1.example.com.pem      # Server certificate

  6. Rename sertificates.

    Example 1 output:

    client.pem      # Client certificate
server.key      # Server key file
server.pem      # Server certificate

  7. Put the certificates and the key with the following names to Hub servers into the nginx/ssl folder (by default, C:/RPA/nginx/ssl).

    Check the Nginx configuration file (by default, C:/RPA/nginx/conf/nginx.conf) on a Windows machine with RPA Hub and make sure that the certificate names and paths match the currently used:

    ssl_certificate ..\ssl\server.pem;
ssl_certificate_key ..\ssl\server.key;
ssl_client_certificate ..\ssl\client.pem;
ssl_verify_client on;

Solution 3. Сonfigure TLS client authentication with existing certificates

  1. Update or generate cleint.jks and server.jks:

    1. Gain shell access to WF server where RPA manager has installed.

    2. Go to the <install_dir>/rpa_manager directory.

  2. Store the existing certificates in cleint.jks and server.jks.

    cd ./common
./rpa.sh -a <RPAHUB_SERVER_DNS> <arbitrary_certificate_alias>
  
# Example
./rpa.sh -a rpa1.example.com rpa1
./rpa.sh -a rpa2.example.com rpa2

  3. Configure application.properties.

    1. Ensure that use.ssl is set to true in the RPA Manager configuration file on APP server: <INSTALL_DIR>/rpa_manager/grid-router/application.properties.
    use.ssl=true
    1. Ensure that use.ssl.client.authorization is set to true in the RPA Manager configuration file on APP server: <INSTALL_DIR>/rpa_manager/grid-router/application.properties.
    use.ssl.client.authorization=true

  4. Modify the PORT variable properly defined (see the RPA Hub configuration) for each RPA Hub in the user.xml configuration file on APP server:

    #link: manager_quota

{INSTALL_DIR}/rpa_manager/grid-router/quota/user.xml. 
#By default it should be 443 port.

  5. Restart the RPA Manager service on APP Server:

    wfmanager restart rpa-manager

  6. Set up Nginx on RPA Hub.

← PreviousNext →