AutoSys Workload Automation

Hello,

We are running on Autosys 11.3.6 SP5 and have 4 environments which are:

• PRD
• SIT
• TST
• DEV

All the environments use the same default username of "autosys". Is there a way to change this username? We would like to have a separate username for each environment. So for example, PRD would use a new username such as autoprd and SIT would use a username such as autosit, etc. 

I have tried to find documentation on how this can be done but so far I have been unable to find any. Everything seems to point to password changes but not on how to change the default username.

Also, is there any pros and cons I should maybe know about doing this?

Thank you!!!

Hi Roberts,

Are you referring to the "autosys" OS user or DB user? If it's the latter, what database are you using?

Thank you,

Chandru

Great Question!

I would like to know both really. So from the DB perspective and from the OS perspective.

We currently use "autosys" for both. For the DB, we are using Oracle.

Thanks!

To change the OS user name (file/group ownership for AE) is not as involved as changing the DB user name.

If the user/group is local to the system, then it's just a matter of changing the file/group ownership of the AE install path recursively (services need to be stopped before changing ownership). If the user is external (LDAP, Active Directory, etc), then ensure relevant 32bit libraries (SSSD, Samba winbind, etc) are installed so that AE is able to lookup the user name correctly.

As for the DB user "autosys" (default) change, although it is doable, it is NOT recommended. One of the reasons being, any changes post installation is not fed back to the installer registry which is used for future upgrade/maintenance. The installer might expect/assume the default "autosys" DB user from the original install during upgrade or repair or patching. Even for audit purposes, one might have to audit multiple users as opposed to autosys user across the board.

If you still choose to do this, then the following steps :

1. Ideally, your DBA should clone/copy the "autosys" DB user as the new/replacement user (e.g; autoprd)

    This might help: Duplicate an Oracle database user - Database Administrators Stack Exchange

2. Grant the UJOADMIN role to the replacement user, for example: autoprd. It is part of the UJOADMIN role privilege reintroduction: https://docops.ca.com/ca-workload-automation-ae/11-4-2/en/installing/ae-installation/reintroduce-the-ujoadmin-role-privi… 

3. Update the DBAccess attribute of the $AUTOUSER/config.$AUTOSERV file with the replacement user and password:

    DBAccess - CA Workload Automation AE & Workload Control Center - CA Technologies Documentation 

4. If you are using Oracle PKI Authentication, then additional steps need to be done:

   https://docops.ca.com/ca-workload-automation-ae/11-4-2/en/installing/ae-installation/environment-and-database-connection… 

I hope this helps!

Best,

Chandru

Always love you're answers as they are very detailed and provide HUGE value. Thank you for that!

In terms of changing the DB User, would this still be a challenge if for example we are moving Autosys from Solaris to Linux which will result in a fresh install.

My thought is that Autosys gets installed fresh in Linux (waiting for release 12 to come out for that), we then setup a brand new database which at that time give it a new username. After that we import everything from the old database to the new.

In that scenario, would you expect there to be any issues?

Also what about password changes?

Do you see any issues with changing the password for Autosys or for the Autosys database? We are attempting to establish protocols which call for the changing all of our application passwords when a person leaves our team for security. 

Just looking for challenges on this or Pros VS Cons?

I really appreciate the great information you provide and look forward to you're comments on this!

Thanks!!!!

Hi Roberts,

A fresh install is not going to be much help with DB user name here because the AE installer does NOT prompt for the DB user name; it prefills 'autosys' for the DB user name and prompts for the password only and that is probably a strong indication that changing DB user isn't recommended/supported. 

I am afraid changing DB user name posts more challenges than I'd initially thought

1) The official procedure (autosys_secure) to change the DB user password is hard-coded with 'autosys' user (it executes SQL:  "ALTER USER autosys IDENTIFIED BY "<password>"), so one has to manually update it.

2) I see the $AUTOSYS/dbobj/ORA/CreateAEDB.pl ($AUTOSYS_USER variable points to 'autosys') script assumes the DB user as 'autosys'. Although the script is editable, any future maintenance (incremental, cumulative, SP) might replace it with the default.

3) The $AUTOSYS/install/vars${AUTOSERV} file has references to 'autosys' database user.

$ grep -i "DB.*USER" ${AUTOSYS}/install/vars${AUTOSERV}
TGT_DBUSER="autosys"
SRC_DBUSER="autosys"
ASI_ADB_USER="autosys"
ASI_DB_USER="autosys"

I believe it'd be a good idea to request this enhancement in the CA WLA Community. The CA WAAE product management might have more to share on the 'why not' if it's turned down. 

Cheers,

Chandru

Great info once again! Exactly what I needed. So just to confirm......

• Changing the OS user used to install Autosys is ok to change
• Changing the OS user password used to install Autosys is ok to change
• You should not change the database username (autosys) even with a clean install
• Changing the database username password is ok to change

Sound right?

Right, on the money

Thanks again for all the help! I really appreciate it!!!!

Another good use case for this "enhancement" would be so in a HA deployment (Primary/Shadow) you could have a distinct database userid for the primary and shadow schedulers(ie..  autosys_primary, autosys_shadow).   This way you could update/rotate the passwords for the database accounts without a outage to autosys (you can just shutdown the node you wish to update the password).

I previously created a ticket with CA asking if it was "supported" to have different userids for the db than autosys and they had told me it was not supported.  So I would not recommend that you use different userids as CA may choose not to support you if you open a support request.

Roberts,

Happy Friday! Chandru is ready to help you -- but it sounds like he needs a bit more information before he can do so. 

Could you come back an answer his questions? We're ready to help!

Yep, just did. Thanks!