9.0

Edit

APP Server post-installation procedures

RPA Manager on APP Server

After RPA Hub installation, you should configure RPA manager manually. The default configuration of RPA manager depends on https_enabled in config.yml:

  • https_enabled = true: RPA manager is configured in SSL mode.
  • https_enabled = false: RPA manager is configured in non-SSL mode. You still need to proceed this post-installation procedures.

During configuration, select one option and follow up the instruction for that. Do not mix steps for different solutions.

Solution 1. Configuration of RPA Manager in non-SSL mode

The solution describes how to set up a non-SSL configuration between RPA manager and RPA Hub.

  1. Verify that use.ssl and use.ssl.client.authorization are set to false in the RPA Manager configuration file on APP server: {INSTALL_DIR}/rpa-manager/grid-router/application.properties.

    use.ssl=false
use.ssl.client.authorization = false

  2. Verify that the NAME variable is properly defined (see the RPA Hub configuration) for each RPA Hub in the user.xml configuration file on APP server:

    #link: manager_quota 

{INSTALL_DIR}/rpa-manager/grid-router/quota/user.xml. 
#By default it is rpa-hub.example.com

    ...
<host name="rpa-hub.example.com" port="4444" count="2"/>
...

  3. Verify that the PORT variable is properly defined (see the RPA Hub configuration) for each RPA Hub in the user.xml configuration file on APP server:

    #link: manager_quota 

{INSTALL_DIR}/rpa-manager/grid-router/quota/user.xml. 
#By default it should be 4444 for non-SSL mode.

    ...
<host name="rpa-hub.example.com" port="4444" count="2"/>
...

  4. Once any changes are made in the RPA Manager configuration files, restart the service:

    wfmanager restart rpa-manager

Solutions 2 and 3. Configuration of RPA Manager in SSL mode

The section provide a brief description how to setup the two way authentication between RPA Manager and RPA Hub. Select one option and follow up the instruction for that, do not mix steps for different solutions.

There are two possibilities to configure TLS client authentication:

  • Using self-signed certificates
  • Using existing certificates

Solution 2. Сonfigure TLS client authentication with self-signed certificates

If RPA Manager and RPA Hub use TLS authentication with self-signed certificates for communications, we should generate cleint.jks and server.jks.

Generate keys and self-signed certificates

  1. Obtain the shell access to APP Server where RPA Manager is installed.

  2. Go to the /rpa-manager directory.

  3. Generate the certificates pair:

    1. Run this script to generate the certificates pair, put them to the /rpa-manager/ssl directory and add them to cleint.jks and server.jks.
    cd <INSTALL_DIR>/rpa-manager/
mkdir ssl
./rpa.sh -g <RPAHUB_SERVER_DNS>
    1. Repeate these steps for each RPA Hub installed.
    note

    You can generate SSL certificates using wildcards. In Example 2 below the asterisks character (*) allows using the certificates for any subdomain of example.com on a few RPA Hub servers. Alternatively, you should run rpa.sh for each RPA Hub installed.

    Possible usage:

    cd <INSTALL_DIR>/rpa-manager/
mkdir ssl
# Example 1
./rpa.sh -g rpahub01.example.com
# Example 2
./rpa.sh -g *.example.com

    Example 1 output:

    ls -1 <INSTALL_DIR>/rpa-manager/ssl

./client-public-rpa1.example.com.cer   
./client-rpa1.example.com.p12      # P12 cert: may be imported to web-browser
./client-rpa1.example.com.pem      # Client certificate
./server-public-rpa1.example.com.cer
./server-rpa1.example.com.key      # Server key file
./server-rpa1.example.com.p12
./server-rpa1.example.com.pem      # Server certificate

Configure application.properties

  1. Ensure that use.ssl is set to true in the RPA Manager configuration file on APP server: <INSTALL_DIR>/rpa-manager/grid-router/application.properties

    use.ssl=true

  2. Ensure, that use.ssl.client.authorization is set to true in the RPA Manager configuration file on APP server: <INSTALL_DIR>/rpa-manager/grid-router/application.properties

    use.ssl.client.authorization=true

Configure RPA Hub quota

  1. Modify the user.xml file on APP server: /rpa-manager/grid-router/quota/user.xml

  2. Put the correct values for hostname, port, and count properties in "<host name="[rpa-hub.example.com](http://rpa-hub.example.com)" port="443" count="2"/>".

    Example:

    <qa:browsers xmlns:qa="urn:config.gridrouter.qatools.ru">
    <browser name="chrome" defaultVersion="1.0">
        <version number="1.0">
            <region name="hub1">
                <host name="rpa-hub.example.com" port="443" count="2"/>
            </region>
        </version>
    </browser>
    <browser name="internet explorer" defaultVersion="11">
        <version number="11">
            <region name="hub1">
                <host name="rpa-hub.example.com" port="443" count="2"/>
            </region>
        </version>
    </browser>
    <browser name="desktop" defaultVersion="1.0">
        <version number="1.0">
            <region name="hub1">
                <host name="rpa-hub.example.com" port="443" count="2"/>
            </region>
        </version>
    </browser>
    <browser name="universal" defaultVersion="1.0">
        <version number="1.0">
            <region name="hub1">
                <host name="rpa-hub.example.com" port="443" count="2"/>
            </region>
        </version>
    </browser>
</qa:browsers>

  3. Restart the RPA manager service on APP Server:

    wfmanager restart rpa-manager

  4. Transfer the following certificates to RPA Hub (Windows Server) and proceed with configuring Nginx with SSL on RPA Hub.

    Example 1 output:

    <INSTALL_DIR>/rpa-manager/ssl/client-rpa1.example.com.pem      # Client certificate
<INSTALL_DIR>/rpa-manager/ssl/server-rpa1.example.com.key      # Server key file
<INSTALL_DIR>/rpa-manager/ssl/server-rpa1.example.com.pem      # Server certificate

  5. Rename certificates.

    Example 1 output:

    client.pem      # Client certificate
server.key      # Server key file
server.pem      # Server certificate

  6. Put the certificates and the key with the following names to Hub servers into the nginx/ssl folder (by default, C:/RPA/nginx/ssl).

  7. Check the Nginx configuration file (by default, C:/RPA/nginx/conf/nginx.conf) on a Windows machine with RPA Hub. Make sure the certificate names and paths match the currently used ones:

    ssl_certificate ..\ssl\server.pem;
ssl_certificate_key ..\ssl\server.key;
ssl_client_certificate ..\ssl\client.pem;
ssl_verify_client on;

Solution 3. Сonfigure TLS client authentication with existing certificates

Update or generate cleint.jks and server.jks

  1. Gain shell access to the WF server where RPA manager is installed.

  2. Go to the <install_dir>/rpa-manager directory.

  3. Store the existing certificates in cleint.jks and server.jks:

    cd ./common
./rpa.sh -a <RPAHUB_SERVER_DNS> <arbitrary_certificate_alias>
  
# Example
./rpa.sh -a rpa1.example.com rpa1
./rpa.sh -a rpa2.example.com rpa2

Configure application.properties

  1. Ensure that use.ssl is set to true in the RPA Manager configuration file on APP server: <INSTALL_DIR>/rpa-manager/grid-router/application.properties

    use.ssl=true

  2. Ensure that use.ssl.client.authorization is set to true in the RPA Manager configuration file on APP server: <INSTALL_DIR>/rpa-manager/grid-router/application.properties

    use.ssl.client.authorization=true

  3. Modify the PORT variable properly defined (see the RPA Hub configuration) for each RPA Hub in the user.xml configuration file on APP server:

    #link: manager_quota

{INSTALL_DIR}/rpa-manager/grid-router/quota/user.xml. 
#By default it should be 443 port.

  4. Restart the RPA Manager service on APP Server:

wfmanager restart rpa-manager
  1. Set up Nginx on RPA Hub.
← PreviousNext →