Update passwords

This guide describes the update of passwords for the installed WorkFusion platform. The guide may be helpful in the following cases:

• The platform was initially installed with weak passwords, and you want to update some or all of them.
• In your organization, you have a password rotation policy, which requires regular passwords update.

The passwords-update procedure comprises the following stages:

1. Stop all running Business Processes in Control Tower.
2. Stop all Product-related services.
3. Destroy workers and clean up rabbitmq queues.
4. On the MASTER server, update config.yml and rpa.yml with new passwords.
5. On the MASTER server, re-encrypt config.yml and rpa.yml.
6. Generate new Vault and Logstash certificates.
7. Copy new config.yml and certificates from MASTER to all other Linux servers.
8. On the RPA server, update user credentials.
9. On the Analytics (BI) server, update user credentials.
10. Update MS SQL logins credentials.
11. Apply the new configuration.
12. Run environment health-check.

info

Once you start to update passwords, make sure to finish it on all servers. Otherwise, your product may not be operational.

Prepare environment

To prepare the environment, follow the instructions below:

1. In your browser, log in to Control Tower, and stop any running Business Processes.
2. Stop all product services (except BI):

Standard setup

3. On the MASTER server (for HA, on the first Master server), adjust variables and execute the commands as WFUSER:

   1. Stop marathon-based apps:

      $ wfmanager stop marathon-apps

   2. Stop supervisord-based apps:

      $ export PACKAGE_DIR=/opt/workfusion/wf_installer
      $ export ANSIBLE_PRIVATE_KEY_FILE='/path/to/ssh-private-key'
      $ export ANSIBLE_VAULT_PASS='your-ansible-vault-pass'
      
      $ cd $PACKAGE_DIR
      $ ./install.sh stop_services full -e skip_bi=true

Multipoint setup

3. On the MASTER server (or for the HA environment, on the first Master server), stop marathon-based apps:

   $ wfmanager stop marathon-apps

   On each Linux server (in the following order: AGENT(s) -> MASTER(s)), run the following command as WFUSER:

   $ wfmanager stop all

4. To destroy workers, on each AGENT server, run the following commands as WFUSER:

   $ pkill -f worker.jar
   # check that there are no running worker processes:
   $ ps aux | grep 'worker.jar'

5. To clean the rabbitmq queues up, on the MASTER server, run the following command as WFUSER:

   $ wfmanager start rabbitmq
   $ rabbitmqctl list_queues --vhost bep | awk '{ print $1 }' | xargs -L1 rabbitmqctl delete_queue --vhost bep
   $ wfmanager stop rabbitmq

For the high-availability mode, do the following:

1. On each MASTER server, start rabbitmq.
2. Execute the rabbitmqctl command for cleanup.
3. Stop rabbitmq.

Update passwords

Note that changing passwords only in the configuration files config.yml or rpa.yml does not update the passwords used by the Product components on different environment servers. These files are the aggregated configurations you usually fill before product installation. They are used only by the installer to read the provided desired settings and save them during deployment to various destinations, where the configuration is stored while the product is running.

To update passwords in config.yml:

1. On the MASTER server, backup your current config.yml:

   $ cd PACKAGE_DIR
   $ cp config.yml config_yml_bak

2. Edit config.yml and change the required passwords:

   $ ./install.sh edit_config master

   You will be prompted to enter your current ansible_vault_password.

   Below is the complete list of passwords that you might want to update. Update the desired settings and save the file.

   ansible_vault_password
   
   wf_password
   
   keycloak_admin_pass
   keycloak_wildfly_mgmt_password
   
   s3_access_key
   s3_secret_key
   java_cacerts_truststore_pass
   marathon_web_pass
   mesos_web_pass
   rabbitmq_ocr_pass
   rabbitmq_bep_pass
   rabbitmq_admin_pass
   nexus_admin_pass
   tableau_dashboard_pass
   tableau_admin_pass
   ocr_sec_pass
   ocr_jwt_secret
   workspace_root_requester_pass
   bot_manager_jwt_secret
   rpa_bot_manager_pass
   
   vault_admin_cert_pass
   vault_client_cert_pass
   elk_logstash_certificate_pass
   
   bi_user
   bi_pass
   
   rpa_user
   rpa_pass
   
   mssql_dba_user
   mssql_dba_pass
   mssql_ct_user
   mssql_ct_pass
   mssql_ws_user
   mssql_ws_pass
   mssql_sqc_user
   mssql_sqc_pass
   mssql_ds_user
   mssql_ds_pass
   mssql_rpa_user
   mssql_rpa_pass
   mssql_pm_user
   mssql_pm_pass
   mssql_dm_user
   mssql_dm_pass
   mssql_rapi_user
   mssql_rapi_pass
   mssql_ocr_user
   mssql_ocr_pass
   mssql_automl_mms_user
   mssql_automl_mms_pass
   
   mssql_keycloak_user
   mssql_keycloak_pass
                       
   mssql_ml_lab_user  
   mssql_ml_lab_pass  

3. To change Keycloak related users' passwords after the initial installation, first modify them in the Keycloak Web Interface (Manage account -> Password), then edit the following parameters in config.yml.

   keycloak_admin_pass: YOUR_PASSWORD
   wf_password: YOUR_PASSWORD

To update passwords in rpa.yml:

1. On the MASTER server, backup your current rpa.yml:

   $ cd PACKAGE_DIR
   $ cp rpa.yml rpa_yml_bak

2. Edit rpa.yml and change the required passwords:

   $ ./install.sh edit_rpa_config master

   You will be prompted to enter your current ansible_vault_password.

   Below is the complete list of passwords that you might want to update. Update the desired settings and save the file.

   # for each unit
   username
   password

3. On the MASTER server, re-encrypt config.yml and rpa.yml:

   Perform this step only if you have updated ansible_vault_password in config.yml.

   To re-encrypt config.yml and rpa.yml with the new password, run the following command:

   $ ./install.sh rekey config

   You will be prompted to enter your old ansible vault password. After command execution, config.yml and rpa.yml become encrypted with a new password you specified during editing.

Generate new Vault and Logstash certificates

info

Perform this step only if you have updated one of the following settings in config.yml:

vault_admin_cert_pass
vault_client_cert_pass
elk_logstash_certificate_pass

To generate new Vault and Logstash certificates, on the MASTER server, execute the following commands as WFUSER:

$ rm -rf ./certificates/_auth_internal/vault*
$ rm -rf ./certificates/_auth_internal/logstash*
$ ./install.sh certs generate

After execution, the new vault and logstash certificates are generated, and your new passwords protect their private keys:

./certificates/_auth_internal/logstash.crt
./certificates/_auth_internal/logstash.key
./certificates/_auth_internal/logstash.p12
./certificates/_auth_internal/vault_admin.crt
./certificates/_auth_internal/vault_admin.p12
./certificates/_auth_internal/vault_workfusion.crt
./certificates/_auth_internal/vault_workfusion.p12

Update RPA credentials

info

Perform this step only if you changed any RPA users' credentials in config.yml or rpa.yml.

If you have changed any of the following settings in config.yml, update the respective RPA Windows credentials on the RPA servers:

rpa_user:
rpa_pass:

bot_master_user_name:
bot_master_user_pass:
bot_unit_base_name:
bot_unit_pass:

The preparation of Windows users is a part of the installation prerequisites, so it is up to you to update them now. You can use both Active directory users or local Windows ones. If you use local Windows users and decide to change only passwords, on the RPA server, go to Computer Management > Local Users and Groups > Users > right-click a user > Set Password and change the passwords.

For the Standard installation, rpa_user and rpa_pass are not used. The installer uses them only in a Standard installation to connect to the RPA server and execute commands remotely. For a Multipoint installation, rpa_user represents the user you use to log in to the RPA machine via RDP. Thus

Only bot_master_user and bot_unit users take part in the product execution.

Update Analytics credentials

info

Do this step only if you're updating BI-related passwords. Mind that, starting from 10.2.9, Tableau is deprecated.

bi_user:
bi_pass:

tableau_dashboard_pass:
tableau_admin_pass:

The Analytics user is a regular Windows account used only by the Ansible installer to connect to the BI server via RDP and execute commands remotely. It doesn't take part in the product execution after installation is finished.

Update bi_user on the BI server only for the Standard installation.

If you have earlier changed tableau_dashboard_pass or tableau_admin_pass, to update the BI credentials:

1. In your browser, log in to Tableau as a current Tableau administrator.
2. Go to the Users tab, click the desired user, then go to the Settings tab > Change Password.

To update the BI credentials in the HA setup:

1. Start your standby BI server, and log in to it with a browser (using direct bi_hostname of standby BI server).
2. Repeat steps 1-2 of the instruction earlier.

Update MS SQL credentials

info

Do this step only if you are updating any of MS SQL users:

mssql_dba_user
mssql_dba_pass
mssql_ct_user
mssql_ct_pass
mssql_ws_user
mssql_ws_pass
mssql_sqc_user
mssql_sqc_pass
mssql_ds_user
mssql_ds_pass
mssql_rpa_user
mssql_rpa_pass
mssql_pm_user
mssql_pm_pass
mssql_dm_user
mssql_dm_pass
mssql_rapi_user
mssql_rapi_pass
mssql_ocr_user
mssql_ocr_pass
mssql_automl_mms_user
mssql_automl_mms_pass
mssql_keycloak_user
mssql_keycloak_pass
mssql_ml_lab_user  
mssql_ml_lab_pass  

To update MS SQL passwords, follow the steps below:

1. Connect to your MS SQL server with MS SQL Management Studio as the administrator user with the "securityadmin" server role at a bare minimum.
2. Update passwords for MS SQL logins.

If you update both passwords and usernames, you can create new MS SQL logins and remove old ones on the MS SQL server.

Distribute updated configuration and certificates

info

Perform this step only for the Standard installation type.

To copy config.yml and certificates from the MASTER server to other Linux servers, use any convenient file transferring method.

The following example demonstrates file sharing from the MASTER server over HTTP.

To distribute updated configuration and certificates across servers:

1. On the MASTER server, go to PACKAGE_DIR where the installer is extracted, and execute the following commands:

   $ cd PACKAGE_DIR
   $ python -m SimpleHTTPServer 8443

   As a result, a similar line appears:

   # Output:
   Serving HTTP on 0.0.0.0 port 8443 ...

   This command makes files in PACKAGE_DIR on the MASTER server downloadable from other servers. Ensure that the port you have chosen is not blocked by a firewall and is accessible on the MASTER server from other Linux servers.

2. On all other Linux hosts (AGENT, OCR), change the PACKAGE_DIR and MASTER_HOSTNMAME variables, and run the commands as WFUSER:

   $ export PACKAGE_DIR=/opt/workfusion/wf_installer
   $ export MASTER_HOSTNAME=master.example.com
   
   $ cd $PACKAGE_DIR
   $ curl -o 'config.yml' http://$MASTER_HOSTNAME:8443/config.yml
   $ curl -o './certificates/_auth_internal/vault_admin.crt' http://$MASTER_HOSTNAME:8443/certificates/_auth_internal/vault_admin.crt
   $ curl -o './certificates/_auth_internal/vault_admin.p12' http://$MASTER_HOSTNAME:8443/certificates/_auth_internal/vault_admin.p12
   $ curl -o './certificates/_auth_internal/vault_workfusion.crt' http://$MASTER_HOSTNAME:8443/certificates/_auth_internal/vault_workfusion.crt
   $ curl -o './certificates/_auth_internal/vault_workfusion.p12' http://$MASTER_HOSTNAME:8443/certificates/_auth_internal/vault_workfusion.p12
   $ curl -o './certificates/_auth_internal/logstash.crt' http://$MASTER_HOSTNAME:8443/certificates/_auth_internal/logstash.crt
   $ curl -o './certificates/_auth_internal/logstash.key' http://$MASTER_HOSTNAME:8443/certificates/_auth_internal/logstash.key
   $ curl -o './certificates/_auth_internal/logstash.p12' http://$MASTER_HOSTNAME:8443/certificates/_auth_internal/logstash.p12

3. Copy the vault_workfusion.p12 certificate from the MASTER to the RPA server. For that, run Powershell as Administrator and execute the following commands:

   $rpa_install_dir  = 'C:\RPA'  # RPA Installation Directory on this server
   $download_from = "master.example.com:8443"  # Hostname of Master server and port on which files are shared
   
   # Downloading vault_workfusion.p12 from Master server and saving it as workfusion.p12 file in ${rpa_install_dir}\bot-agent\ssl\ directory
   $wc = New-Object net.webclient
   $wc.Downloadfile("http://${download_from}/certificates/_auth_internal/vault_workfusion.p12", "${rpa_install_dir}\bot-agent\ssl\workfusion.p12")
   $wc.Downloadfile("http://${download_from}/certificates/_auth_internal/vault_workfusion.p12", "${rpa_install_dir}\worker\ssl\workfusion.p12")

4. On the MASTER server, stop file-sharing by pressing Control+C (or Command+C on Mac).

Apply configuration

Standard setup

To apply configuration, follow the steps below:

1. On the MASTER server, run the following commands:

   $ export PACKAGE_DIR=/opt/workfusion/wf_installer
   $ export ANSIBLE_PRIVATE_KEY_FILE='/path/to/ssh-private-key'
   $ export ANSIBLE_VAULT_PASS='your-ansible-vault-pass'
   
   $ cd $PACKAGE_DIR
   $ ./install.sh precheck mssql
   $ ./install.sh configure mssql
   $ ./install.sh configure full

   Perform the following steps only if you're updating the password for the Vault client's certificate:

   vault_client_cert_pass

2. Update Vault p12 certificates on the RPA servers:

   1. On the MASTER server, go to PACKAGE_DIR (the directory where the installer is extracted), and execute:

   $ cd PACKAGE_DIR
   $ python -m SimpleHTTPServer 8443
   # Output:
   Serving HTTP on 0.0.0.0 port 8443 ...

   This makes files in PACKAGE_DIR on the Master server downloadable from other servers. Ensure that the port you have chosen is accessible on the Master server (not blocked by firewalls) from other Linux servers.

   2. On the RPA server, run Powershell as Administrator, and execute the following commands:

      $rpa_install_dir  = 'C:\RPA'  # RPA Installation Directory on this server
      $download_from = "master.example.com:8443"  # Hostname of the Master server and port on which files are shared
      
      # Downloading vault_workfusion.p12 from Master server and saving it as workfusion.p12 file in ${rpa_install_dir}\bot-agent\ssl\ directory
      $wc = New-Object net.webclient
      $wc.Downloadfile("http://${download_from}/certificates/_auth_internal/vault_workfusion.p12", "${rpa_install_dir}\bot-agent\ssl\workfusion.p12")
      $wc.Downloadfile("http://${download_from}/certificates/_auth_internal/vault_workfusion.p12", "${rpa_install_dir}\worker\ssl\workfusion.p12")

3. Reboot the RPA server

Multipoint setup

To apply configuration, follow the steps below:

1. On the MASTER server, run the following commands:

   $ export PACKAGE_DIR=/opt/workfusion/wf_installer
   $ export ANSIBLE_VAULT_PASS='your-ansible-vault-pass'
   
   $ cd $PACKAGE_DIR
   $ ./install.sh precheck mssql -c local
   $ ./install.sh configure mssql -c local
   $ ./install.sh configure master -e skip_common=true -c local --limit <current_hostnmame>

2. On the AGENT server, run the following commands:

   $ export PACKAGE_DIR=/opt/workfusion/wf_installer
   $ export ANSIBLE_VAULT_PASS='your-ansible-vault-pass'
   
   $ cd $PACKAGE_DIR
   $ ./install.sh configure agent -c local --limit <current_hostnmame>

3. On the OCR server, run the following commands:

   $ export PACKAGE_DIR=/opt/workfusion/wf_installer
   $ export ANSIBLE_VAULT_PASS='your-ansible-vault-pass'
   
   $ cd $PACKAGE_DIR
   $ ./install.sh configure ocr -c local --limit <current_hostnmame>

4. To push OCRWin configs to ZooKeeper and Vault, on the MASTER server, run the commands (only if Windows OCR is used):

   $ export PACKAGE_DIR=/opt/workfusion/wf_installer
   $ export ANSIBLE_VAULT_PASS='your-ansible-vault-pass'
   
   $ cd $PACKAGE_DIR
   $ ./install.sh configure ocrwin -c local --limit <current_hostnmame>

Update Tableau data sources connection string

info

Do this step only if you're updating MS SQL BI-related passwords. Mind that, starting from 10.2.9, Tableau is deprecated.

mssql_dm_user
mssql_dm_pass

1. Log in to Tableau as administrator.
2. Go to Datasouces, click More (•••) next to a required datasource, and then click Connection.
3. Change Username and Password.
4. Click <<Test Connection>>.
5. Click Save.

Check environment

To check the environment, follow the steps below:

1. Wait for the environment to stabilize after services startup for about 5-7 minutes.

2. On the MASTER server, run the command:

   $ ./install.sh check master -c local --limit <current_hostnmame> -e test_ml=true -e test_rpa=true -e test_ie=true -e test_desktop=true -e test_ocr=true