Edit

Upgrade password

This guide describes the process of passwords update for already installed Workfusion SPA product.We assume that "passwords" are any settings specified in secrets.yml file before installation.You might need this guide for the following reasons, for example:Workfusion SPA was installed initially with weak passwords and you want to update some or all of them.You have a password rotation policy in your organization which requires regular passwords update.

Predefined common variables:

• WorkFusion user. Default is wfuser.
• WorkFusion Home Directory. Default is /opt/workfusion.
• WorkFusion Installer Directory. Default is /opt/workfusion/wf_installer.

Steps

1. Stop services. Run on all linux servers (DB, APP, APM, OCR, AutoML master, AutoML agents) under <WF_USER>:

   wfmanager stop all
   

2. On DB server, populate the secrets.yml file with the settings you want to apply.

   vi <PACKAGE_DIR>/secrets.yml
   

3. On DB server, ensure that the file with sensitive settings from the initial installation exists:

   <INSTALL_DIR>/distr/latest/secrets_overrides.yml
   

   The mentioned file is encrypted. The decryption password is stored in the <PACKAGE_DIR>/VAULT_PASSWORD.DELETE_ME file. If you deleted VAULT_PASSWORD.DELETE_ME after installation, you should restore it.

4. To update passwords for vault certificates (the following settings in secrets.yml), do as follows:

   vault_admin_cert_pass
   vault_workfusion_cert_pass
   vault_sandbox_cert_pass
   

5. Regenerate vault certificates:

   cd <PACKAGE_DIR>
   mkdir certificates_backup
   mv certificates/vault* certificates_backup/
   ./generate-certificates.sh cert-vault
   

6. Update passwords on DB server:

   cd <PACKAGE_DIR>
   ./install.sh passwords_update db -e previous_secrets_file=<INSTALL_DIR>/distr/latest/secrets_overrides.yml --vault-password-file=VAULT_PASSWORD.DELETE_ME
   

7. Copy newly generated vault certificates (if you regenerated them), the secrets.yml, secrets_overrides.yml, and VAULT_PASSWORD.DELETE_ME files from the initial installation from DB server to all other Linux servers (APP, OCR, APM, AutoML master, AutoML agents) to the same locations as on DB server. Then update passwords on all other servers one by one (APP > OCR > APM > AutoML master > AutoML agents):

   cd <PACKAGE_DIR>
   ./install.sh passwords_update <server_role> -e previous_secrets_file=<INSTALL_DIR>/distr/latest/secrets_overrides.yml --vault-password-file=VAULT_PASSWORD.DELETE_ME
   

8. Replace <server_role> with a respective server role (supported values: app, ocr, apm, vds-master, vds-slave).

If you updated any of the following settings:

rpa_manager_truststore_pass
rpa_manager_keystore_pass
rpa_manager_key_pass

then, during the password update procedure, RPA-related certificates were re-generated, rpa-manager's truststore and keystore were recreated from scratch. Do as follows:

1. On APP server, navigate to the <INSTALL_DIR>/rpa-manager directory. You'll find the previously backed-up ssl directory with RPA-related certificates, rpa-manager's java truststore and keystore, for example:

   ls -la <INSTALL_DIR>/rpa-manager/ssl_backup-2018-11-28-1543436265/
   total 40
   drwxrwxr-x. 2 wfuser wfuser 4096 Nov 28 20:29 .
   drwxr-xr-x. 6 wfuser wfuser 182 Nov 28 20:18 ..
   -rw-r--r--. 1 wfuser wfuser 3273 Nov 28 15:48 client.jks
   -rw-r--r--. 1 wfuser wfuser 911 Nov 28 15:48 client-public-rh75-580-rpa1.workfusion.com.cer
   -rw-r--r--. 1 wfuser wfuser 2735 Nov 28 15:48 client-rh75-580-rpa1.workfusion.com.p12
   -rw-r--r--. 1 wfuser wfuser 1596 Nov 28 15:48 client-rh75-580-rpa1.workfusion.com.pem
   -rw-r--r--. 1 wfuser wfuser 3272 Nov 28 15:48 server.jks
   -rw-r--r--. 1 wfuser wfuser 911 Nov 28 15:48 server-public-rh75-580-rpa1.workfusion.com.cer
   -rw-r--r--. 1 wfuser wfuser 1880 Nov 28 15:48 server-rh75-580-rpa1.workfusion.com.key
   -rw-r--r--. 1 wfuser wfuser 2735 Nov 28 15:48 server-rh75-580-rpa1.workfusion.com.p12
   -rw-r--r--. 1 wfuser wfuser 1596 Nov 28 15:48 server-rh75-580-rpa1.workfusion.com.pem
   

   You'll also find a newly created directory with new certificates, truststore, and keystore, for example:

   $ ls -la <INSTALL_DIR>/rpa-manager/ssl/
   total 40
   drwxrwxr-x. 2 wfuser wfuser 4096 Nov 28 20:18 .
   drwxr-xr-x. 6 wfuser wfuser 182 Nov 28 20:18 ..
   -rw-rw-r--. 1 wfuser wfuser 3218 Nov 28 20:18 client.jks
   -rw-rw-r--. 1 wfuser wfuser 893 Nov 28 20:18 client-public-rh75-580-rpa1.workfusion.com.cer
   -rw-rw-r--. 1 wfuser wfuser 2684 Nov 28 20:18 client-rh75-580-rpa1.workfusion.com.p12
   -rw-rw-r--. 1 wfuser wfuser 1545 Nov 28 20:18 client-rh75-580-rpa1.workfusion.com.pem
   -rw-rw-r--. 1 wfuser wfuser 3218 Nov 28 20:18 server.jks
   -rw-rw-r--. 1 wfuser wfuser 893 Nov 28 20:18 server-public-rh75-580-rpa1.workfusion.com.cer
   -rw-rw-r--. 1 wfuser wfuser 1871 Nov 28 20:18 server-rh75-580-rpa1.workfusion.com.key
   -rw-rw-r--. 1 wfuser wfuser 2684 Nov 28 20:18 server-rh75-580-rpa1.workfusion.com.p12
   -rw-rw-r--. 1 wfuser wfuser 1545 Nov 28 20:18 server-rh75-580-rpa1.workfusion.com.pem
   

2. Update certificates on RPA Hub server. Copy the certs from the ssl directory on APP server to RPA Hub:

   server-rh75-580-rpa1.workfusion.com.pem
   server-rh75-580-rpa1.workfusion.com.key
   client-rh75-580-rpa1.workfusion.com.pem
   

If you updated any of the following settings:

wfagent_username
wfagent_password

Then, make sure that you updated the wfagent's config on RPA Hub server.

If you updated any of the following settings:

wf_tableau_automation_username
wf_tableau_automation_password
wf_tableau_dashboard_username 
wf_tableau_dashboard_password

Then, make sure you updated them on Analytics server as well.

important

Once you start the password update procedure, make sure to finish it on EVERY server. Otherwise, your product will not be operational. Make sure you use THE SAME secrets.yml, secrets_overrides.yml and vault certificates files ON EVERY server. If you change database usernames, you can remove previous users manually (for example, any DB users). If you don't change usernames but just passwords, no additional actions are required.