Pega Robotics Studio 8: password management for automations
When logging in to various systems or opening protected Excel files, the password is required and till now usually hard coded within the automation. Apart from having bad maintainability, we also noticed the password is written to the log files; for example, the following automation snippet:
produces the following log line:
Info | 12:56:57.516 午後 | 1 | STA | Automation | trilogy_login | Project1 | Automation: trilogy_login propagating From: trilogy_login.password.Value To client_text_input.client_text_input._EntryPointExecute().param2 Value: Pxxxxxxxxx
This is at "Info" log level, so the only way to stop the password appearing in clear text in the log would be to set the log to "Error" level which would make operational troubleshooting much more difficult. Ideally we would like just this one control to not log, but all other controls and/or automations to log at Info level - is there a way to do this?
When logging in to various systems or opening protected Excel files, the password is required and till now usually hard coded within the automation. Apart from having bad maintainability, we also noticed the password is written to the log files; for example, the following automation snippet:
produces the following log line:
Info | 12:56:57.516 午後 | 1 | STA | Automation | trilogy_login | Project1 | Automation: trilogy_login propagating From: trilogy_login.password.Value To client_text_input.client_text_input._EntryPointExecute().param2 Value: Pxxxxxxxxx
This is at "Info" log level, so the only way to stop the password appearing in clear text in the log would be to set the log to "Error" level which would make operational troubleshooting much more difficult. Ideally we would like just this one control to not log, but all other controls and/or automations to log at Info level - is there a way to do this?
More generally, what are Robotics' best practices for managing passwords? As mentioned, it's best for it to not be hard coded and we thought of managing the passwords in an Excel file, but that Excel file is also password protected and its location and password will appear in the log files
**Moderation Team has archived post**
This post has been archived for educational purposes. Contents and links will no longer be updated. If you have the same/similar question, please write a new post.
Accepted Solution
ANZ
IN
Hi,
You can right click and mark that data line as sensitive. And see how the password looks like.
Normally , we ask the user to provide the password in the very beginning " after start up of automation" so that we can keep it on a credential store, or keep in a encrypted file ".net based" or in ASO "Assisted Sign On" . so that OpenSpan can use it through out the automation life cycle.
Note: We do delete the respective password store folders when runtime exits
Pegasystems Inc.
JP
Sorry, where do I right click? I can't seem to find a "sensitive" option anywhere.
Incidentally, the passwords are not revealed to the users so they can't provide it.
Pegasystems Inc.
US
Yes. In the Help, there are articles for both of these.
http://help.openspan.com/80/Components/Using_the_Credential_Store_Component.htm
http://help.openspan.com/80/Innovations/Assisted_Sign-On_Component.htm
Pegasystems Inc.
JP
Thank you! That is exactly the answer that our customer needed. I have marked this as answered.
Slight deviation from the main aim of this article, but any general best practices for password management would still be welcome: in general maintaining passwords outside is better than hard-coding, but even the password management system would require a password which itself would end up being hardcoded. The only way to avoid hard coding any passwords, saving them in clear text, or prompting the user for it, would be some sort of IdP as in SSO? Is there anything like that in the Robotics world?
ANZ
IN
Hi,
The way we used is: We have an .net component with a XML file. so the component is responsible to encrypt and decrypt the password with a unique Key.
when the component is used in OpenSpan we used the key to decrypt and use the filed.
Pegasystems Inc.
US
Look at the ASOManager component. ASOManager (Assisted Sign On) allows you to store user IDs and passwords in an encrypted data store in the user profile. This is encrypted with MSDPAPI which means it is directly tied to the user's profile and password.
This component provides dialogs for maintaining credentials and methods for setting and getting credentials.