Skip to main content
Version: 10.3

Configure Secrets Vault

Secrets Vault use cases​

Secrets Vault addresses the following major use cases.

Store passwords of legacy applications​

Scope: passwords used by automations.

Applications: legacy applications without integrated password management.

Benefits: ability to securely store sensitive third-party and external passwords.

Out of the box: by default, WorkFusion uses Secrets Vault as a storage backend for such passwords.

Integration: alternatively, passwords can be retrieved from the established password management software (CyberArk AIM, Dell TPAM, and so on). In such cases, passwords are retrieved in the automation logic through API.

See also:

Store internal Work.AI passwords​

Scope: passwords that are used by a Work.AI component or a module to connect to another component.

Benefits: elimination of plain text passwords from configuration files.

Out of the box: WorkFusion stores such passwords in bundled Secrets Vault.

Examples:

  • Database password used by Control Tower
  • OCR password used by Control Tower

Platform configuration properties​

Secure: the properties that contain sensitive information and stored in Secrets Vault.

Non-secure: the set of properties is not secure and can be defined or changed on the Master server, in the INSTALL_DIR/wf-sec-storage/ directory in the following files (if you have the OCR server installed on the same server):

  • ocr-rest-secure.properties
  • ocr-worker-secure.properties

Control Tower secure properties​

The following properties must be configured by a separate method. If you apply the properties with an empty value, they are erased from the system.

s3.access-key
s3.secret-key
s3.context.key.map
s3.context.key.map.presign
jwt.secret
bot.manager.jwt.secret
jwt.issuer
ldap.server.url
ldap.bind.dn
ldap.bind.password
wf.sso.saml.metadata.admin.username
wf.sso.saml.metadata.admin.password
wf.sso.saml.metadata.admin.authorities
wf.sso.saml.idp.metadata
wf.sso.saml.idp.file.metadata
wf.sso.saml.sp.metadata
wf.sso.saml.username.attribute
automl.services.endpoint
automl.services.username
automl.services.password
automation.application.url
automation.username
automation.password
nexus.url
nexus.user
nexus.password
mail.username
mail.password
workfusion.accessKey
workfusion.secretKey
hazelcast.group.name
hazelcast.group.password
twilio.account.sid
twilio.auth.token
twilio.application.sid

ct.datasource.url
ct.datasource.username
ct.datasource.password

ds.datasource.url
ds.datasource.username
ds.datasource.password

spring.rabbitmq.host
spring.rabbitmq.port
spring.rabbitmq.virtual-host
spring.rabbitmq.username
spring.rabbitmq.password

Workspace secure properties​

The following properties are stored separately and required to configure Workspace:

ws.datasource.username
ws.datasource.password
ws.secure.jwt.secret
ws.secure.ldap.server.url
ws.secure.ldap.bind.dn  
ws.secure.ldap.bind.password
ws.sso.saml.idp.metadata
ws.sso.saml.idp.file.metadata
ws.sso.saml.username.attribute  
ws.sso.saml.sp.metadata
ws.mail.username
ws.mail.password

OCR secure properties​

The following properties are stored separately in ocr-rest-secure.properties and ocr-worker-secure.properties and are required for the OCR configuration.

The following properties are the same for Windows and Linux OCR.

ocr-rest-secure.properties​

jwt.secret
ocr.task.sn
ocr.task.engine.license.password
ocr.task12.sn
ocr.task12.engine.license.password
spring.security.username
spring.security.password
spring.rabbitmq.username
spring.rabbitmq.password
spring.datasource.username
spring.datasource.password

ocr-worker-secure.properties​

spring.rabbitmq.username
spring.rabbitmq.password
spring.datasource.username
spring.datasource.password

View secrets​

To view all passwords used in Work.AI, follow the steps below:

  1. Log in to the Master server via SSH as the application user.

  2. Go to the INSTALL_DIR directory.

    cd /opt/workfusion/wf-sec-storage/

  3. Run the following command:

    ./loader.sh ansible review
    Output example
    [INFO ] You are working with safe : workfusion_ansible_secrets
    [INFO ] Properties from secure storage

    [INFO ] Key : Value
    [INFO ] ansible_vault_password : secret_value
    [INFO ] bot_manager_jwt_secret : secret_value
    [INFO ] bot_relay_user_name : secret_value
    [INFO ] bot_relay_user_pass : secret_value
    [INFO ] bot_user_base_name : secret_value
    [INFO ] bot_user_pass : secret_value
    [INFO ] ca_key_pass : secret_value
    [INFO ] rpa_bots_per_server : secret_value
    [INFO ] elk_admin_password : secret_value
    [INFO ] elk_elastic_password : secret_value
    [INFO ] elk_kibana_certificate_pass : secret_value
    [INFO ] elk_kibana_password : secret_value
    [INFO ] elk_logstash_certificate_pass : secret_value
    [INFO ] elk_logstash_password : secret_value
    [INFO ] hazelcast_port : secret_value
    [INFO ] install_dir : secret_value
    [INFO ] internet_access : secret_value
    [INFO ] ldap_bind_dn : secret_value
    [INFO ] ldap_bind_password : secret_value
    [INFO ] ldap_enabled : secret_value
    [INFO ] ldap_group_base : secret_value
    [INFO ] ldap_group_filter : secret_value
    [INFO ] ldap_internal_authorization_enabled : secret_value
    [INFO ] ldap_server_url : secret_value
    [INFO ] ldap_user_base : secret_value
    [INFO ] ldap_user_filter : secret_value
    [INFO ] wfuser : secret_value
    [INFO ] log_level_type : secret_value
    [INFO ] mail_host : secret_value
    [INFO ] mail_pass : secret_value
    [INFO ] mail_port : secret_value
    [INFO ] mail_sender : secret_value
    [INFO ] mail_user : secret_value
    [INFO ] marathon_proxy_port : secret_value
    [INFO ] marathon_web_password : secret_value
    [INFO ] mesos_master_port : secret_value
    [INFO ] mesos_slave_port : secret_value
    [INFO ] mesos_slave_port_range : secret_value
    [INFO ] mesos_web_password : secret_value
    [INFO ] mssql_ct_pass : secret_value
    [INFO ] mssql_ct_user : secret_value
    [INFO ] mssql_dba_pass : secret_value
    [INFO ] mssql_dba_user : secret_value
    [INFO ] mssql_dm_api_pass : secret_value
    [INFO ] mssql_dm_api_user : secret_value
    [INFO ] mssql_dm_pass : secret_value
    [INFO ] mssql_dm_user : secret_value
    [INFO ] mssql_ds_pass : secret_value
    [INFO ] mssql_ds_user : secret_value
    [INFO ] mssql_external : secret_value
    [INFO ] mssql_ocr_pass : secret_value
    [INFO ] mssql_ocr_user : secret_value
    [INFO ] mssql_pm_pass : secret_value
    [INFO ] mssql_pm_user : secret_value
    [INFO ] mssql_port : secret_value
    [INFO ] mssql_rapi_pass : secret_value
    [INFO ] mssql_rapi_user : secret_value
    [INFO ] mssql_rpa_pass : secret_value
    [INFO ] mssql_rpa_user : secret_value
    [INFO ] mssql_sa_pass : secret_value
    [INFO ] mssql_sqc_pass : secret_value
    [INFO ] mssql_sqc_user : secret_value
    [INFO ] mssql_ws_pass : secret_value
    [INFO ] mssql_ws_user : secret_value
    [INFO ] nexus_admin_pass : secret_value
    [INFO ] nexus_api_pass : secret_value
    [INFO ] nexus_deployment_pass : secret_value
    [INFO ] nginx_port : secret_value
    [INFO ] nginx_port_ssl : secret_value
    [INFO ] ocr_jwt_secret : secret_value
    [INFO ] ocr_platform : secret_value
    [INFO ] ocr_sec_pass : secret_value
    [INFO ] rabbitmq_api_proxy_port : secret_value
    [INFO ] rabbitmq_bep_pass : secret_value
    [INFO ] rabbitmq_ocr_pass : secret_value
    [INFO ] rabbitmq_vds_pass : secret_value
    [INFO ] rpa_bot_agent_pass : secret_value
    [INFO ] rpa_bot_manager_pass : secret_value
    [INFO ] s3_access_key : secret_value
    [INFO ] s3_secret_key : secret_value
    [INFO ] sso_saml_enabled : secret_value
    [INFO ] sso_saml_idp_file_metadata : secret_value
    [INFO ] sso_saml_idp_metadata : secret_value
    [INFO ] sso_saml_sp_metadata : secret_value
    [INFO ] sso_saml_username_attribute : secret_value
    [INFO ] vault_admin_cert_pass : secret_value
    [INFO ] vault_port : secret_value
    [INFO ] vault_workfusion_cert_pass : secret_value
    [INFO ] wf_group : secret_value
    [INFO ] wf_password : secret_value
    [INFO ] wfuser : secret_value
    [INFO ] wf_username : secret_value
    [INFO ] win_install_dir : secret_value
    [INFO ] windows_installation_pass : secret_value
    [INFO ] windows_installation_user : secret_value
    [INFO ] workspace_license_access_key : secret_value
    [INFO ] workspace_license_secret_key : secret_value
    [INFO ] workspace_root_requester_pass : secret_value
    [INFO ] ws_enable_worker_email_confirmation : secret_value
    [INFO ] ws_ldap_requester_groups : secret_value
    [INFO ] ws_ldap_worker_groups : secret_value
    [INFO ] zookeeper_port : secret_value
    [INFO ] It's all

Configure Secrets Vault on production environment​

When deploying the Product to the production environment, you must mandatorily configure Secrets Vault entries.

However, if developers are allowed to do that on production servers, they can violate security policies by reading other departments' Secrets Vault entries.

To avoid that, use any of the following rules:

  • Restrict developers from accessing the production servers.
  • Restrict developers to view Secrets Vault by assigning permissions and appropriate roles. For more information, see Manage Control Tower roles and permissions.
  • Add user-assigned filters so that a developer can only view Secrets Vault entries with a specific prefix. For more information, see Set up filters for collaborative work.
  • Change the code review process to ensure that Secrets Vault entries are not displayed in logs, stored in Data Stores, or placed to the RPA system in plain text.