Changing the Authentication Method

Once defined, changing the authentication method is possible but it involves considerable effort since the Automation Engine and all Agents must be restarted.

To Change the Authentication Method from NO to LOCAL (Server)

  1. End all Agents.
  2. End all server processes.

  3. Export the Authentication Key to a file. You do so in batch mode using the AE.DB Load utility (see Start Parameters - Utilities).

    The Authentication Key has not yet been set in the database.

  4. Make this file available to all Agents. For this purpose, enter the following in their INI files:

    1. In InitialPackage= ([AUTHORIZATION] section), enter the path and name of the Authentication Key file.
    2. In KeyStore=, enter the path and name of the file in which the Agent should store the Authentication Key information.

    Important! Make sure that both files are stored in protected directories.

  5. Set the Authentication Method (in this case, LOCAL) and the Authentication Key in the database. You do this in batch mode using the AE.DB Load utility.
  6. Start all server processes.

  7. For security reasons, withdrawing the authentication from all Agents is recommended.

    The LOCAL Authentication Method is based on the principle that the Agents will be manually authenticated in the Administration perspective to guarantee that the Agent is not a program of a potential hacker.

    You can skip this step if you are sure you want to make the changeover without this security measure.

    To withdraw the Agent authentication, do the following:

    1. In the Agents list in the Administration perspective, select all Agents.
    2. Right-click and select Withdraw Authentication.
  8. Start all Agents.
  9. The Agents read the Authentication Key file and store the information in their KeyStore files. Then, they delete the Authentication Key file automatically.

  10. If you followed our recommendation and withdrew the authentication from the Agents, you must authenticate them now:

    1. In the Agents list in the Administration perspective, select all Agents.
    2. Right-click and select Authenticate Agent.

    Important! Authenticated Agents that are not authenticated cannot log on to the Automation Engine system.

To Change the Authentication Method from NO to LOCAL_REMOTE (Server and Agent)

With the LOCAL_REMOTE method the Agents require a file in which the Authentication Package is stored. As this file differs for each Agent, it must be generated individually and made available to the corresponding computers.

  1. End all Agents.
  2. End all server processes.

  3. Change the Authentication Method to LOCAL_REMOTE. You do so in batch mode using the AE.DB Load utility (see Start Parameters - Utilities).

    The Authentication Key is now written to the database.

  4. Start all server processes.
  5. Log on to system client 0000 and open the Administration perspective.
  6. Open the list of Agents.

  7. For security reasons, withdrawing the authentication from all Agents is recommended.

    The LOCAL_REMOTE Authentication Method is based on the principle that the Agents will be manually authenticated in the Administration perspective to guarantee that the Agent is not a program of a potential hacker.

    You can skip this step if you are sure you want to make the changeover without this security measure.

    To withdraw the Agent authentication, do the following:

    1. In the Agents list in the Administration perspective, select all Agents.
    2. Right-click and select Withdraw Authentication.

  8. Export an Authentication Package for each individual Agent:

    1. In the Agents list, select all Agents.
    2. Right-click and select Download Authentication Package.

    Note: You need W (Write) permissions for the Agent object to be able to export the Authentication Package.

  9. Save the Authentication Package in a secure folder on the Agent's computer.

  10. In the INI file of each Agent:

    • In InitialPackage= ([AUTHORIZATION] section) enter the path and name of the Authentication Package.
    • In KeyStore= enter the path and name of the Agent's KeyStore file in which the Agent will store the information retrieved from the Authentication Package.

    Important! Make sure that both files are stored in protected directories.

  11. Start all Agents.
  12. The Agents read the Authentication Package files and store the information in their respective KeyStore files. Then they delete the Authentication Package file automatically.

To Change the Authentication Method from LOCAL to LOCAL_REMOTE (Server to Server and Agent)

As the Agents have already been authenticated, you can easily switch from LOCAL to LOCAL_REMOTE and viceversa. You do it in the UC_AS_SETTINGS variable. (See UC_AS_SETTINGS - Advanced Security).

  1. Log in to Client 0.

  2. Enter UC_AS_SETTINGS in the Global Search field.

  3. A dropdown list with a link to the variable opens up. Click it to displya the UC_AS_SETTINGS variable.
  4. Activate the checkbox next to AUTHENTICATION.
  5. Click the file icon in the Value 1 column to open the Cell Editor, where you can enter LOCAL_REMOTE.
  6. Save your changes.
  7. End all server processes.

  8. Start all server processes.

    Agents will automatically connect after the time (in seconds) specified in the RECONNECT_TIME parameter (See UC_HOSTCHAR_DEFAULT - Host Characteristics.

To Change the Authentication Method from LOCAL (Server) or LOCAL_REMOTE (Server and Agent) to NO

With Authentication Method "NO", the Agents do not require the Authentication Key that is stored in the Automation Engine database. Therefore, the Agents' keystore files must be deleted. You do it in the UC_AS_SETTINGS variable. (See UC_AS_SETTINGS - Advanced Security).

  1. End all Agents.
  2. Log in to Client 0.

  3. Enter UC_AS_SETTINGS in the Global Search field.

  4. A dropdown list with a link to the variable opens up. Click it to display the UC_AS_SETTINGS variable.
  5. Activate the checkbox next to AUTHENTICATION.
  6. Click the file icon in the Value 1 column to open the Cell Editor, where you can enter NO.
  7. Save your changes.
  8. End all server processes.

  9. Delete the Authentication Key from the database.

    For this purpose, process the following SQL statement in a transaction: delete from oha.

  10. Start all server processes.

  11. Delete the KeyStore file in each Agent. Its path and name are stored in the KeyStore= parameter of their respective INI files.
  12. Start all Agents.

See also: