9.2

Edit

Upgrade password

This guide describes the process of passwords update for already installed Workfusion SPA product.We assume that "passwords" are any settings specified in secrets.yml file before installation.You might need this guide for the following reasons, for example:Workfusion SPA was installed initially with weak passwords and you want to update some or all of them.You have a password rotation policy in your organization which requires regular passwords update.

Predefined common variables:

  • WorkFusion user. Default is wfuser
  • WorkFusion Home Directory. Default is /opt/workfusion
  • WorkFusion Installer Directory. Default is /opt/workfusion/wf_installer

The steps are as follows:

  1. Stop services. Run on all Linux servers (DB, APP, APM, OCR, AutoML master, AutoML agent[s]) under <WF_USER>:

    wfmanager stop all

  2. On DB server, populate the secrets.yml file with the settings you want to apply.

    vi <PACKAGE_DIR>/secrets.yml

  3. On DB server, ensure that the file with sensitive settings from initial installation exists:

    <INSTALL_DIR>/distr/latest/secrets_overrides.yml

    The mentioned file is encrypted. Decryption password is stored in file <PACKAGE_DIR>/VAULT_PASSWORD.DELETE_ME. If you deleted the VAULT_PASSWORD.DELETE_ME file after the installation, you should restore it.

    If you want to update passwords for vault certificates (the following settings in secrets.yml):

    vault_admin_cert_pass
vault_workfusion_cert_pass
vault_sandbox_cert_pass

    you'll need to regenerate vault certificates. Run the following:

    cd <PACKAGE_DIR>
mkdir certificates_backup
mv certificates/vault* certificates_backup/
./generate-certificates.sh cert-vault

  4. Update passwords on DB server:

cd <PACKAGE_DIR>
./install.sh passwords_update db -e previous_secrets_file=<INSTALL_DIR>/distr/latest/secrets_overrides.yml --vault-password-file=VAULT_PASSWORD.DELETE_ME

  1. Copy newly generated vault certificates (if you regenerated them), secrets.yml file, secrets_overrides.yml and VAULT_PASSWORD.DELETE_ME file from initial installation from DB server to all other linux servers (APP, OCR, APM, AutoML master, AutoML agent[s]) to the same locations as on DB server. Then update passwords on all other servers one by one (APP > OCR > APM > AutoML master > AutoML agent(s)):

    cd <PACKAGE_DIR>
./install.sh passwords_update <server_role> -e previous_secrets_file=<INSTALL_DIR>/distr/latest/secrets_overrides.yml --vault-password-file=VAULT_PASSWORD.DELETE_ME

  2. Replace <server_role> with respective server role (supported values: app, ocr, apm, vds-master, vds-slave)

If you updated any of the following settings:

rpa_manager_truststore_pass
rpa_manager_keystore_pass
rpa_manager_key_pass

then during passwords-update procedure RPA-related certificates were re-generated, rpa-manager's truststore and keystore were recreated from scratch.
On APP server navigate to <INSTALL_DIR>/rpa-manager directory. You'll find there previous backed-up ssl directory with RPA-related certificates, rpa-manager's java truststore and keystore. Example:

ls -la <INSTALL_DIR>/rpa-manager/ssl_backup-2018-11-28-1543436265/
total 40
drwxrwxr-x. 2 wfuser wfuser 4096 Nov 28 20:29 .
drwxr-xr-x. 6 wfuser wfuser 182 Nov 28 20:18 ..
-rw-r--r--. 1 wfuser wfuser 3273 Nov 28 15:48 client.jks
-rw-r--r--. 1 wfuser wfuser 911 Nov 28 15:48 client-public-rh75-580-rpa1.workfusion.com.cer
-rw-r--r--. 1 wfuser wfuser 2735 Nov 28 15:48 client-rh75-580-rpa1.workfusion.com.p12
-rw-r--r--. 1 wfuser wfuser 1596 Nov 28 15:48 client-rh75-580-rpa1.workfusion.com.pem
-rw-r--r--. 1 wfuser wfuser 3272 Nov 28 15:48 server.jks
-rw-r--r--. 1 wfuser wfuser 911 Nov 28 15:48 server-public-rh75-580-rpa1.workfusion.com.cer
-rw-r--r--. 1 wfuser wfuser 1880 Nov 28 15:48 server-rh75-580-rpa1.workfusion.com.key
-rw-r--r--. 1 wfuser wfuser 2735 Nov 28 15:48 server-rh75-580-rpa1.workfusion.com.p12
-rw-r--r--. 1 wfuser wfuser 1596 Nov 28 15:48 server-rh75-580-rpa1.workfusion.com.pem

You'll also find newly created directory with new certificates, truststore and keystore. Example:

$ ls -la <INSTALL_DIR>/rpa-manager/ssl/
total 40
drwxrwxr-x. 2 wfuser wfuser 4096 Nov 28 20:18 .
drwxr-xr-x. 6 wfuser wfuser 182 Nov 28 20:18 ..
-rw-rw-r--. 1 wfuser wfuser 3218 Nov 28 20:18 client.jks
-rw-rw-r--. 1 wfuser wfuser 893 Nov 28 20:18 client-public-rh75-580-rpa1.workfusion.com.cer
-rw-rw-r--. 1 wfuser wfuser 2684 Nov 28 20:18 client-rh75-580-rpa1.workfusion.com.p12
-rw-rw-r--. 1 wfuser wfuser 1545 Nov 28 20:18 client-rh75-580-rpa1.workfusion.com.pem
-rw-rw-r--. 1 wfuser wfuser 3218 Nov 28 20:18 server.jks
-rw-rw-r--. 1 wfuser wfuser 893 Nov 28 20:18 server-public-rh75-580-rpa1.workfusion.com.cer
-rw-rw-r--. 1 wfuser wfuser 1871 Nov 28 20:18 server-rh75-580-rpa1.workfusion.com.key
-rw-rw-r--. 1 wfuser wfuser 2684 Nov 28 20:18 server-rh75-580-rpa1.workfusion.com.p12
-rw-rw-r--. 1 wfuser wfuser 1545 Nov 28 20:18 server-rh75-580-rpa1.workfusion.com.pem

Update certificates on RPA Hub server. Copy these certs from "ssl" directory on APP server to RPA Hub:

server-rh75-580-rpa1.workfusion.com.pem
server-rh75-580-rpa1.workfusion.com.key
client-rh75-580-rpa1.workfusion.com.pem

If you updated any of the following settings:

wfagent_username
wfagent_password

Make sure that you updated wfagent's config on RPA Hub server.

If you updated any of the following settings:

wf_tableau_automation_username
wf_tableau_automation_password
wf_tableau_dashboard_username 
wf_tableau_dashboard_password

Make sure that you updated them on Analytics server as well.

important
  • Once you started passwords-update procedure, make sure to finish it on EVERY server. Otherwise, your product will not be operational.
  • Make sure that you use the same secrets.yml, secrets_overrides.yml and vault certificates files ON EVERY server.
  • If you changed database `usernames`, it is up to you to remove previous users manually (e.g. any db users) if you wish. If you didn't change usernames, but just passwords, no additional actions required.
← PreviousNext →