Changing the Authentication Method

You can change the authentication method after it has been defined. However, it involves considerable effort since the Automation Engine and all Agents must be restarted.

This page includes the following:

Changing from NO to LOCAL (Server)

  1. End all Agents.

  2. End all server processes.

  3. Export the Authentication Key to a file. You can do so in batch mode using the AE.DB Load utility, see Start Parameters - Utilities.

    The Authentication Key has not yet been set in the database.

  4. Make sure the Key file is available to all Agents. To do so, define the following parameter(s) in the [AUTHORIZATION] section of the respective Agent INI file:

    1. In the InitialPackage= parameter, enter the path and name of the Authentication Key file.

    2. If you have non-TLS/SSL Agents, in the KeyStore= parameter, enter the path and name of the file in which the Agent should store the Authentication Key information. TLS/SSL agents do not require this parameter.

    Important! Make sure that both files are stored in protected directories.

  5. Set the Authentication Method (in this case, LOCAL) and the Authentication Key in the database. You can do so in batch mode using the AE.DB Load utility.

  6. Start all server processes.

  7. For security reasons, it is recommended withdrawing the authentication from all Agents.

    The LOCAL Authentication Method is based on the principle that the Agents will be manually authenticated in the Administration perspective to guarantee that the Agent is not a program of a potential hacker.

    You can skip this step if you are sure you want to make the changeover without this security measure.

    To withdraw the Agent authentication, do the following:

    1. In the Agents list in the Administration perspective, select all Agents.

    2. Right-click and select Withdraw Authentication.

  8. Start all Agents.

  9. The Agents read the Authentication Key file and store the information in their KeyStore files. Then, they delete the Authentication Key file automatically.

  10. If you followed our recommendation and withdrew the authentication from the Agents, you must authenticate them now:

    1. In the Agents list in the Administration perspective, select all Agents.

    2. Right-click and select Authenticate Agent.

    Important! Authenticated Agents that are not authenticated cannot log on to the Automation Engine system.

Changing from NO to LOCAL_REMOTE (Server and Agent)

With the LOCAL_REMOTE method the Agents require a file in which the Authentication Package is stored. As this file differs for each Agent, it must be generated individually and made available to the corresponding computers.

  1. End all Agents.

  2. End all server processes.

  3. Change the Authentication Method to LOCAL_REMOTE. You can do so in batch mode using the AE.DB Load utility, see Start Parameters - Utilities.

    The Authentication Key is now written to the database.

  4. Start all server processes.

  5. Log on to system Client 0 and open the Administration perspective.

  6. Open the list of Agents.

  7. For security reasons, it is recommended withdrawing the authentication from all Agents.

    The LOCAL_REMOTE Authentication Method is based on the principle that the Agents will be manually authenticated in the Administration perspective to guarantee that the Agent is not a program of a potential hacker.

    You can skip this step if you are sure you want to make the changeover without this security measure.

    To withdraw the Agent authentication, do the following:

    1. In the Agents list in the Administration perspective, select all Agents.

    2. Right-click and select Withdraw Authentication.

  8. Export an Authentication Package for each individual Agent:

    1. In the Agents list, select all Agents.

    2. Right-click and select Download Authentication Package.

    Note: You need W (Write) permissions for the Agent object to be able to export the Authentication Package.

  9. Save the Authentication Package in a secure folder on the Agent's computer.

  10. Define the following parameter(s) in the [AUTHORIZATION] section of the respective Agent INI file:

    • In the InitialPackage= parameter, enter the path and name of the Authentication Package.

    • If you have non-TLS/SSL Agents, in the KeyStore= parameter, enter the path and name of the Agent's KeyStore file in which the Agent will store the information retrieved from the Authentication Package. TLS/SSL agents do not require this parameter.

    Important! Make sure that both files are stored in protected directories.

  11. Start all Agents.
  12. The Agents read the Authentication Package files and store the information in their respective KeyStore files. Then they delete the Authentication Package file automatically.

Changing from LOCAL to LOCAL_REMOTE (Server to Server and Agent)

As the Agents have already been authenticated, you can easily switch from LOCAL to LOCAL_REMOTE and vice versa. You can do so in the UC_AS_SETTINGS variable. For more information, see UC_AS_SETTINGS - Advanced Security.

  1. Log in to Client 0.

  2. Enter UC_AS_SETTINGS in the Global Search field.

  3. A dropdown list with a link to the variable opens up. Click it to display the UC_AS_SETTINGS variable.
  4. Activate the checkbox next to AUTHENTICATION.
  5. Click the file icon in the Value 1 column to open the Cell Editor, where you can enter LOCAL_REMOTE.
  6. Save your changes.
  7. End all server processes.

  8. Start all server processes.

    Agents will automatically connect after the time (in seconds) specified in the RECONNECT_TIME parameter. For more information, see UC_HOSTCHAR_DEFAULT - Host Characteristics.

Changing from LOCAL (Server) or LOCAL_REMOTE (Server and Agent) to NO

You can change the authentication method to NO in the UC_AS_SETTINGS variable. For more information, see UC_AS_SETTINGS - Advanced Security.

When you use the Authentication Method "NO", the Agents do not require the Authentication Key that is stored in the Automation Engine database.

  1. End all Agents.
  2. Log in to Client 0.

  3. Enter UC_AS_SETTINGS in the Global Search field.

  4. A dropdown list with a link to the variable is displayed. Click it to display the UC_AS_SETTINGS variable.
  5. Activate the checkbox next to AUTHENTICATION.
  6. Click the file icon in the Value 1 column to open the Cell Editor, where you can enter NO.
  7. Save your changes.
  8. End all server processes.

  9. Delete the Authentication Key from the database.

    To do so, process the following SQL statement in a transaction: delete from oha.

  10. Start all server processes.

  11. If you have non-TLS/SSL Agents, delete the KeyStore file which is stored in the KeyStore= parameter in the [AUTHORIZATION] section of the corresponding Agent INI file.
  12. Start all Agents.

See also: