9.3

Edit

Security configuration

Authentication

Platform Monitor supports Form-based authentication

Authentication is enabled by default (it turns on during installation).

auth: form

Form-based authentication

This authentication should be enabled for all Platform Monitor agents (WF Agents).
These agents should be accessible to target users with configured credentials.
The best practice is that Hub and Node1 (slave) agents should be accessible only from APM (master) server.
Master Platform Monitor has only one configuration of credentials for every slave Platform Monitor.
That is why any Platform Monitor should use only one configuration and you should use only one user and it is not possible to create different credentials for slave Platform Monitor.

Details about proxy Platform Monitor

A proxy mechanism is way to transfer data from slave Platform Monitor to master Platform Monitor.
Platform Monitor has push proxy mechanism that means slave PM sends data to master PM.

For slave Platform Monitor, it is enabled by check.

checks:
 - id: proxy.push
   description: "Sent proxy objects to APM"
   type: sync
   schedule: 10
   source: APM

To clear older data from master when slave Platform Monitor is off, use this check:

checks:
  - id: agent-alive
    type: java
    schedule: 20
    evaluate:
      - id: agent.alive

Platform Monitor transfers following types of data:

  • ALERTS

  • METRICS

  • ITEMS

  • GROUPS

  • COMPONENTS

  • INCIDENTS

  • PROCESSES

  • COMMANDS

  • AGENT (information by itself)

PM server

To enable form-based (with a login page) authentification for Platform Monitor (wfagent), add the following lines to the configuration file.

config.yml:

auth: form

security:
 user:
    name: wfagent
    password: changeit

To check a new configuration, access the agent UI via a browser. You should see a login form like this:

To log in into the application, use credentials from the configuration file.

Connecting agents

All Platform Monitor agents should have additional configuration to connect to APM server

  1. Add a credentials entry:
 credentials:
   - id: pm
     user: "admin"
     password: "admin"
     url: "http://${environment.pm_hostname}:${environment.pm_port}/login"

Make sure you don't create a duplicate credentials section. There should be valid pm_hostname and pm_port variables in the environments section.

  1. Modify a Sync check. Add the credentials: pm line to the pm.sync check.
- id: pm.sync
  type: sync
  schedule: 20
  credentials: pm
  source: PmMaster

Enable access to Platform Monitor via Control Tower

To enable the access to Platform Monitor from Control Tower and see a new menu item that redirects to Platform Monitor, perform the following steps:

  1. Configure permissions to a user role in Control Tower.

The logged-in user role should contain any of the Platform Monitor specific permissions:

  • PM_VIEW_STATISTICS

  • PM_EXECUTE_ACTIONS

    By default, the permissions are available in the following roles of Control Tower: ROLE_ADMINROLE_SUPER_ADMIN

  1. Check that during the Control Tower installation, the pm.application.host property is overridden in <TOMCAT_HOME>/conf/workfusion.properties, for example:
pm.application.host=http\://local-beautify-rest-api.crowdcomputingsystems.com:10101
  1. Add the following properties to VAULT:
pm.jwt.secret=SuQ6fzt5693XRmGueUhSbQ==
  1. Try to log in to Platform Monitor via Control Tower under the required user.
property encryption

For instructions on how to enable properties encryption, refer to Platform Monitor configuration.

← PreviousNext →