Edit

Upgrade password

This guide describes the process of passwords update for the already installed Workfusion SPA product. We assume that passwords are any settings specified in secrets.yml file before installation. You might need this guide for the following reasons, for example:

• Workfusion SPA was installed initially with weak passwords, and you want to update some or all of them.
• You have a password rotation policy in your organization which requires regular passwords update.

Predefined common variables are as follows:

• The WorkFusion user is wfuser by default.
• The WorkFusion Home Directory is /opt/workfusion by default.
• The WorkFusion Installer Directory is /opt/workfusion/wf_installer by default.

The steps are as follows:

1. Stop services. Run on all Linux servers (DB, APP, APM, OCR, AutoML Master, AutoML Agents) under <WF_USER>:

   wfmanager stop all
   

2. On the DB server, populate the secrets.yml file with the settings you want to apply.

   vi <PACKAGE_DIR>/secrets.yml
   

3. On the DB server, ensure that the file with sensitive settings from the initial installation exists:

   <INSTALL_DIR>/distr/latest/secrets_overrides.yml
   

   The mentioned file is encrypted. The decryption password is stored in the<PACKAGE_DIR>/VAULT_PASSWORD.DELETE_ME file. If you deleted the VAULT_PASSWORD.DELETE_ME file after the installation, you should restore it.

4. To update the passwords for Vault certificates, find the following settings in secrets.yml:

   vault_admin_cert_pass
   vault_workfusion_cert_pass
   vault_sandbox_cert_pass
   

5. Regenerate Vault certificates. Run the following:

   cd <PACKAGE_DIR>
   mkdir certificates_backup
   mv certificates/vault* certificates_backup/
   ./generate-certificates.sh cert-vault
   

6. Update the passwords on the DB server:

   cd <PACKAGE_DIR>
   ./install.sh passwords_update db -e previous_secrets_file=<INSTALL_DIR>/distr/latest/secrets_overrides.yml --vault-password-file=VAULT_PASSWORD.DELETE_ME
   

7. Copy the newly generated Vault certificates (if you regenerated them), secrets.yml file, secrets_overrides.yml, and VAULT_PASSWORD.DELETE_ME from the initial installation on the DB server to all other Linux servers (APP, OCR, APM, AutoML master, AutoML Agents) to the same locations as on the DB server. Then, update the passwords on all other servers one by one (APP > OCR > APM > AutoML master > AutoML Agents):

   cd <PACKAGE_DIR>
   ./install.sh passwords_update <server_role> -e previous_secrets_file=<INSTALL_DIR>/distr/latest/secrets_overrides.yml --vault-password-file=VAULT_PASSWORD.DELETE_ME
   

8. Replace \<server_role> with the respective server role. Supported values: app, ocr, apm, vds-master, vds-slave.

   If you updated any of the following settings:

   rpa_manager_truststore_pass
   rpa_manager_keystore_pass
   rpa_manager_key_pass
   

   Then, during the password update procedure, RPA-related certificates were re-generated, RPA Manager's truststore and keystore were recreated from scratch.

9. On the APP server, navigate to <INSTALL_DIR>/rpa-manager directory. You'll find there the previously backed-up ssl directory with RPA-related certificates, RPA Manager's Java truststore and keystore, for example:

   ls -la <INSTALL_DIR>/rpa-manager/ssl_backup-2018-11-28-1543436265/
   total 40
   drwxrwxr-x. 2 wfuser wfuser 4096 Nov 28 20:29 .
   drwxr-xr-x. 6 wfuser wfuser 182 Nov 28 20:18 ..
   -rw-r--r--. 1 wfuser wfuser 3273 Nov 28 15:48 client.jks
   -rw-r--r--. 1 wfuser wfuser 911 Nov 28 15:48 client-public-rh75-580-rpa1.workfusion.com.cer
   -rw-r--r--. 1 wfuser wfuser 2735 Nov 28 15:48 client-rh75-580-rpa1.workfusion.com.p12
   -rw-r--r--. 1 wfuser wfuser 1596 Nov 28 15:48 client-rh75-580-rpa1.workfusion.com.pem
   -rw-r--r--. 1 wfuser wfuser 3272 Nov 28 15:48 server.jks
   -rw-r--r--. 1 wfuser wfuser 911 Nov 28 15:48 server-public-rh75-580-rpa1.workfusion.com.cer
   -rw-r--r--. 1 wfuser wfuser 1880 Nov 28 15:48 server-rh75-580-rpa1.workfusion.com.key
   -rw-r--r--. 1 wfuser wfuser 2735 Nov 28 15:48 server-rh75-580-rpa1.workfusion.com.p12
   -rw-r--r--. 1 wfuser wfuser 1596 Nov 28 15:48 server-rh75-580-rpa1.workfusion.com.pem
   

   You'll also find the newly created directory with new certificates, truststore, and keystore, for example:

   $ ls -la <INSTALL_DIR>/rpa-manager/ssl/
   total 40
   drwxrwxr-x. 2 wfuser wfuser 4096 Nov 28 20:18 .
   drwxr-xr-x. 6 wfuser wfuser 182 Nov 28 20:18 ..
   -rw-rw-r--. 1 wfuser wfuser 3218 Nov 28 20:18 client.jks
   -rw-rw-r--. 1 wfuser wfuser 893 Nov 28 20:18 client-public-rh75-580-rpa1.workfusion.com.cer
   -rw-rw-r--. 1 wfuser wfuser 2684 Nov 28 20:18 client-rh75-580-rpa1.workfusion.com.p12
   -rw-rw-r--. 1 wfuser wfuser 1545 Nov 28 20:18 client-rh75-580-rpa1.workfusion.com.pem
   -rw-rw-r--. 1 wfuser wfuser 3218 Nov 28 20:18 server.jks
   -rw-rw-r--. 1 wfuser wfuser 893 Nov 28 20:18 server-public-rh75-580-rpa1.workfusion.com.cer
   -rw-rw-r--. 1 wfuser wfuser 1871 Nov 28 20:18 server-rh75-580-rpa1.workfusion.com.key
   -rw-rw-r--. 1 wfuser wfuser 2684 Nov 28 20:18 server-rh75-580-rpa1.workfusion.com.p12
   -rw-rw-r--. 1 wfuser wfuser 1545 Nov 28 20:18 server-rh75-580-rpa1.workfusion.com.pem
   

10. Update the certificates on the RPA Hub server. Copy these certs from the ssl directory on the APP server to the RPA Hub as described in Update from non-SSL to SSL:

    server-rh75-580-rpa1.workfusion.com.pem
    server-rh75-580-rpa1.workfusion.com.key
    client-rh75-580-rpa1.workfusion.com.pem
    

If you updated any of the following settings:

wfagent_username
wfagent_password

Make sure that you updated the wfagent's config on the RPA Hub server based on Platform Monitor configuration.

If you updated any of the following settings:

wf_tableau_automation_username
wf_tableau_automation_password
wf_tableau_dashboard_username 
wf_tableau_dashboard_password

Make sure that you updated them on the Analytics server as well based on BI Windows Server Installation.

important

Once you started the password update procedure, make sure to finish it on EVERY server. Otherwise, your product will not be operational.

Make sure that you use THE SAME secrets.yml, secrets_overrides.yml, and Vault certificates files on every server. If you changed database usernames, you can remove the previous users manually (for example, any db users) if you wish. If you didn't change usernames but just passwords, no additional actions are required.