Overview

Credentials are the user ID and password under which an Agent runs tasks on the machine where the Agent resides.

By default, an Agent will run tasks under the same Credentials used to install the Agent. However, via the Controller user interface, you also can define Credentials and assign them to any task or Agent.

When prompted for Credentials, the Agent looks in the following locations, in this order, for a user ID and password:

1. If the task specifies Credentials, the Agent uses those Credentials.
2. If the task does not specify Credentials, the Agent uses the Credentials specified in its Agent Details record.
3. If the Agent Details does not specify Credentials, the Agent uses the Credentials used to install the Agent.

Types of Credentials

There are four types of Credentials:

Converting Credential Types

You can convert a Credential from any type to any type.

To convert a Credential type from Standard to Resolvable, Web Service, or Email, the Resolvable Credentials Permitted, Web Service Credentials Permitted, or Email Credentials Permitted Universal Controller system property, respectively, must be set to true.

To convert a Credential, either:

• Click the Convert... button in the Credential Details.
• Select Convert... in the Credentials Details action menu.
• Select Convert... for a specific Credential in the Credentials List action menu.

When you convert a Credential, you must provide a new password. The Controller will not convert an encrypted password of one Credential type to an encrypted password of a different Credential type.

Credentials Compatibility

As of Universal Controller 6.4.x, the Credential Runtime Passwords, along with the LDAP Settings Bind Password, Email Connection Passwords, Promotion Target Passwords, and Promotion Schedule Promotion Passwords, now are encrypted using AES with 128-bit keys.

Additionally, Standard and Resolvable Credentials are encrypted using separate keys; therefore, an encrypted password for a Standard Credential cannot be decrypted by the Resolvable Credential framework.

Under the following circumstances, conversion from the old encryption to the new encryption will be automatic. Furthermore, all pre-6.4.x credentials will be recognized as Standard credentials.

• Apply maintenance to a pre-6.4.x release of Universal Controller to increase it to a 7.2.x release.
• Perform a bulk import or list import from a pre-6.4.x release of Universal Controller to a 7.2.x release.
• Promote from a pre-6.4.x release of Universal Controller to a 7.2.x release.

Under the following circumstance, conversion from the new encryption to the old encryption will be automatic.

• Promote from a 7.2.x release of Universal Controller to a compatible pre-6.4.x release. However, any attempt to promote a Resolvable Credential from a 7.2.x release of Universal Controller to a compatible pre-6.4.x release will fail.

Pre-6.4.0.0 releases cannot decrypt anything encrypted by a 7.2.x release, with the exception of promotion (noted above), which is fully backwards compatible.

Please note the following backwards compatibility constraints with respect to List Import, Bulk Import, and the Universal Controller Start-up Properties (opswise.properties).

• Any attempt to List Import or Bulk Import XML (containing a password encrypted by a 7.2.x release) into a pre-6.4.0.0 release will result in an encrypted value that cannot be decrypted by the pre-6.4.0.0 release.
• Any encrypted passwords within the Universal Controller Start-up Properties will be re-encrypted using the new algorithm when the 7.2.x Controller initializes at start-up. Once converted, that Universal Controller Start-up Properties will no longer be compatible with a pre-6.4.0.0 release.

Resolvable Credentials

Resolvable Credentials are meant to be used with scripts and commands specified in tasks, and resolved when the script or command is executed. They provide the script or command with access to Credentials (user name and password) without having to hard-code the Credentials in the script, command, or parameters itself.

In order to enable the use of Resolvable Credentials, the Resolvable Credentials Permitted Universal Controller system property must be set to true (default is false).

If the Resolvable Credentials Permitted property is set to false, the following restrictions on Resolvable Credentials apply:

• You cannot create a Resolvable Credential.
• You cannot convert a Standard Credential to a Resolvable Credential.
• Any attempt to launch a task with an embedded Resolvable Credential will result in a Start Failure status.

Using Resolvable Credentials in a Script

To use Resolvable Credentials with a script, embed the Resolvable Credentials in any of the following:

• Content of a Script specified in the Script field in a Linux/Unix or Windows task.
• Content of a Data Script.
• Universal Template Script (Script, Linux/Unix Script, or Windows Script field).
• Content of a Script specified in the Payload Script field in a Web Service task.

Using Resolvable Credentials in a Task

To use Resolvable Credentials with a task, embed the Resolvable Credentials in any of the following:

Embedding Resolvable Credentials

Five Controller Credentials Functions are available for embedding Resolvable Credentials:

Variables are supported for these Functions.

For example:

• ${_credentialKeyLoc('${my_credential}')}
• ${_credentialPassphrase('${my_credential}')}
• ${_credentialToken('${my_credential}')}
• ${_credentialUser('${my_credential}')}
• ${_credentialPwd('${my_credential}')}

In the resolved script, these Functions are resolved to (for example):

• $(ops_unv_cred_key_loc_08236da16c3944899aae5a874da077bb)
• $(ops_unv_cred_passphrase_08236da16c3944899aae5a874da077bb)

• $(ops_unv_cred_token_08236da16c3944899aae5a874da077bb)

• $(ops_unv_cred_user_08236da16c3944899aae5a874da077bb)

• $(ops_unv_cred_pwd_08236da16c3944899aae5a874da077bb)

Additionally, for a Universal Template, you can create a Field of Type = Credential, which lets you select or create Resolvable Credentials. The Controller will create a variable for the Resolvable Credential Field, which you can embed in the Universal Template script using the Credentials Functions. This also lets you change Credentials when you run a Universal Task based on the Universal Template.

Restrictions on Embedding Resolvable Credentials

If an embedded Credential is not a Resolvable Credential, the task instance will transition into the Start Failure status with one of the following status descriptions:

• Execution with credentials "credential-name", contained within the Universal Template Script, prohibited due to credential type constraint; only Resolvable credential type permitted.
• Execution with credentials "credential-name", contained within the command field or parameters field prohibited due to credential type constraint; only Resolvable credential type permitted.
• Execution with credentials "credential-name", contained within the script "script-name", prohibited due to credential type constraint; only Resolvable credential type permitted.
• For Web Service tasks:
  Execution with credentials "credential-name", contained within the "<URL Query Parameter/Form Data/Payload/Payload Script/HTTP Headers>" field, prohibited due to credential type constraint; only Resolvable credential type permitted.

If the Execution User for a task instance does not have Execute permission for an embedded Resolvable Credential, the task instance will transition to the Start Failure status with one of the following status descriptions:

• Execution with credentials "credential-name", contained within the Universal Template Script, prohibited due to security constraints.
• Execution with credentials "credential-name", contained within the command field or parameters field, prohibited due to security constraints.
• Execution with credentials "credential-name", contained within the script "script-name", prohibited due to security constraints.
• Execution with credentials "credential-name", contained within a script, prohibited due to security constraints.
• For Web Service tasks:
  Execution with credentials "credential-name", contained within the "<URL Query Parameter/Form Data/Payload/Payload Script/HTTP Headers>" field, prohibited due to security constraints.

If the Resolvable Credentials Permitted Universal Controller system property is set to false, any task instance with an embedded Resolvable Credential will result in a Start Failure status with the following status description:

• Execution with resolvable credentials not permitted; Universal Controller property "Resolvable Credentials Permitted" is not enabled.
• For Web Service tasks:
  • Execution with resolvable credentials not permitted; Universal Controller property "Web Service Task Resolvable Credentials Functions Permitted" is not enabled
  • Execution with resolvable credentials not permitted; Universal Controller property "Resolvable Credentials Permitted" and "Web Service Task Resolvable Credentials Functions Permitted" are not enabled

If an embedded Resolvable Credential cannot be decrypted, the task instance will transition into the Start Failure status with the following status description:

• Unable to decrypt password for "credential-name" credentials.

Other Credentials

You can embed source and destination Credentials in a UDM script using File Transfer Task Instance built-in variables.

For File Transfer tasks, the Agent may need additional credentials for logging on to the FTP server.

Defining a Credential

Credential Details

The following Credential Details is for an existing credential. See the field descriptions, below, for a description of all fields that display in the Credential Details.

For information on how to access additional details - such as Metadata and complete database Details - for Credentials (or any type of record), see Records.

Credential Details Field Descriptions

The following table describes the fields, buttons, and tabs that display in the Credential Details.
 

Deleting a Credential

You cannot delete a Credential if any references exist for the Credential.

References will be checked according to the Credential type, as shown in the following table: