Changing passwords in CLM product applications

You might need to update passwords after you have already installed BMC Cloud Lifecycle Management. But before you change any passwords, you must recognize that the passwords of one application are integrated with other applications in the cloud solution. When you change passwords, you must update the same password in other applications and configurations. This topic contains the following information:

Video series – Changing passwords in CLM product applications

The videos in this section provides detailed conceptual information and step-by-step instructions on how to change passwords in BMC Cloud Lifecycle Management applications. These videos demonstrate the password dependencies between the applications in the BMC Cloud Lifecycle Management solution.

The following video (07:29) shows how to change the BBNA and BBSA passwords:

  https://youtu.be/rNMTIV505pc 

The following video (09:09) shows how to change the AR System Demo password:

  https://youtu.be/5mwghlBX8nw 

The following video (07:56) shows how to change the CSM Super User password:

  https://youtu.be/7s5mlg-MM9I 

Password dependencies between applications

When you change passwords, you must carefully check if there are any external applications or resources that use any of the accounts and passwords you are changing. Review the following table of password dependencies in BMC Cloud Lifecycle Management. For example, if you change the AR Demo user password, you must also change the password in BMC Network Automation (BBNA), BMC Server Automation (BBSA), and the Platform Manager JSON file. 

_{Back to top}

Before you start

• Before you change any passwords, take VM snapshots and database backups of your systems. These snapshots are incredibly important if you accidentally break the integration between the cloud products or if your systems become unstable. You can revert to the saved snapshot, troubleshoot the problem, and then try again. 
• Don't change all your passwords at the same time. Change the Demo password first and get it working properly after you have completed all the integration changes. Then change the password of a different application, for example, BMC Server Automation, and so on. Otherwise, you risk serious impersonate errors, like the following:
  call: getListEntryWithFields(), TableName: Location, Class:com.bmc.cloud.model.beans.Location. Server response authenticity for login type IMPERSONATE cannot be validated:{1} (ARERR 219009)

To change AR System server passwords

The following instructions are for all BMC Remedy or CLM users of the BMC AR System servers. This includes the dual Enterprise-AR and Cloud-AR servers that were used in BMC Cloud Lifecycle Management before the 4.x release. 

_{Back to top}

To change the AR System Demo user password

The following instructions apply to any other normal AR System user logins as well.

1. Log on to the AR System server as the Demo user (or a user for which password needs to be changed). 
   You can only change the password of your current login, for example, Demo; the Demo user cannot change the password of any other user.  
2. Open the Change Password form in Submit mode (you must append ?mode=Submit to the URL, as shown in the example URL).
   The direct access URL is:
   http://MidTierServer:8080/arsys/forms/ARServer/User+Password+Change/Default+Admin+View/?mode=Submit&cacheid=e239aae0
   
3. Enter correct Current Password for the Demo user. 
4. Enter and confirm the New Password.
   
5. Click Save.

6. Log out of the AR System server and then log back in as Demo to test the new password.

_{Back to top}

To change the AR System Application Service Password

1. Log on to AR System server as Demo.
2. From IT Home, open the AR System Administration Console. by clicking Applications > AR System Administration > AR System Administration Console. 
3. Select System > General > Server Information. 
4. Click the Connection Settings tab.
5. Change the Application Service Password to the new password, and then click Apply.
    
6. Click OK.

_{Back to top}

To change the AR System server password in Email Engine and Flashboards configuration

When changing the Application Service Password, you must also update this password in the Email Engine configuration and Flashboards server configuration.
To update this password in the Email Engine configuration:

1. Back up and save the following files:
   C:\Program Files\BMC Software\ARSystem\AREmail\EmailDaemon.properties
   C:\Program Files\BMC Software\ARSystem\AREmail\EmailStart.bat

2. Edit the EmailStart.bat file and replace %* at the end of the execute line with -p <changed Application Service Password>:
   Previous version:

   ..... com.bmc.arsys.emaildaemon.EmailDaemon %* 

   
   Updated version: 

   ..... com.bmc.arsys.emaildaemon.EmailDaemon -p NewApplicationServicePassword

3. Execute EmailStart.bat from the command line to update the password in the EmailDaemon.properties file.
4. Edit EmailStart.bat file, and revert it back to its original form.
5. Restart the Email Engine service.
6. Review the .\Logs\stdout.log and .\Logs\stderr.log files to make sure that the connection is successful.

_{Back to top}

To update this password in the Flashboards server configuration:

1. From the Linux command line or the Windows command prompt, change directories to the Flashboards installation directory (for example, C:\Program Files\BMC Software\ARSystem\flashboards).

2. Enter the following commands (based on your installation and product versions).
   Review the install directory for the corresponding .jar files and specify the correct names and install directory path.
   For Microsoft Windows (which uses semi-colons):

   java -classpath arutil81_build001.jar;flashd81_build001.jar; -DflashInstallPath=FlashboardsInstallationDirectory FBDriver
   java -classpath arutil81_build001.jar;flashd81_build001.jar; -DflashInstallPath="C:\Program Files\BMC Software\ARSystem\flashboards" FBDriver 

   
   For Linux (which uses colons): 

   java -classpath arutil81_build001.jar:flashd81_build001.jar: -DflashInstallPath=FlashboardsInstallationDirectory FBDriver

3. Enter spw to set the password.
    
4. Follow the remaining instructions on the screen.

_{Back to top}

To change the database password of the AR System Server database

1. Log on to the AR System server as Demo.
2. From IT Home, open the AR System Administration Console. by clicking Applications > AR System Administration > AR System Administration Console. 
3. Select System > General > Server Information.
4. Click the Database tab.
5. Enter the new database password in the Database Password field.
    d
6. Click OK.

_{Back to top}

To change the password of the database user on the Oracle database server

1. For Oracle, connect to the database instance as sys/system whose database user password must be changed.
2. Run the following command:
   alter user <username> identified by <password>;
   
   Where:
   <username> is the name of database user (typically ARAdmin)
   <password> is the new password
   
   For example:
   sqlplus sys/clmAdm1n@ARSystem as sysdba
   SQL> alter user ARAdmin identified by bmcAdm1n; 
3. After changing the password, verify the database password from the satabase host.
   For example:
   [oracle@clm-db1 bin]$ sqlplus ARAdmin/bmcAdm1n@ARSystem 
4. After changing the CSM Super User, AR Database, AR Mid-Tier, or AR DSO Password, restart the AR Services.

_{Back to top}

To change the CSM Super User or AO User password in the CMF:PluginConfiguration form

1. Use the BMC Customer Support utility (BMC Support Knowledge Article (000031948)) to encrypt the new passwords you are setting.
   

   Tip

   Use the AR component name to encrypt the CSM Super Use password. 
    
2. Log on to ITSM AR System server as Demo.
3. Open the CMF:PluginConfiguration form in Search mode.
   For example:
   http://MidTierServer:8080/arsys/forms/ARServer/CMF%3APluginConfiguration 
4. Click Search.
5. If you generated a new password for CSM Super User:
   
   
   1. Select the CSM_SUPER_USER_PASSWORD record from the results list. 
   2. Update the Value field with the new encrypted password. 
   3. Click Save to save the updated record.
6. If you generated a new password for AO User password:
   
   
   1. Select the FIELD_AO_PASSWORD record from the results list.
   2. Update the Value field with the new encrypted password. 
   3. Click Save to save the updated record.
7. After you change the CSM Super User password, restart the AR System service on the AR System host.

_{Back to top}

To change the Mid Tier configuration password

1. Go to the Mid Tier Configuration URL.
   For example: 
   http://MidTierServer:8080/arsys/shared/config/config.jsp
2. Enter the Mid Tier configuration password (by default it is arsystem).
3. Click Change Password.
   
4. Enter the correct Old Password.
5. Enter and confirm the New Password.
    
6. Click Change Password.

_{Back to top}

To change the Mid Tier administrator password

Update the administrator password used by the Mid Tier to connect to the AR System in the Connection Settings tab of the AR System server.

1. Log on to AR System server as Demo.
2. From IT Home, open the AR System Administration Console. by clicking Applications > AR System Administration > AR System Administration Console. 
3. Select System > General > Server Information.
4. Click the Connection Settings tab.
5. Update the Mid-Tier Administrator Password with a new password.
    
6. Click OK.
7. Log on to the Mid Tier Configuration form.
   For example: 
   http://MidTierServer:8080/arsys/shared/config/config.jsp
8. Click AR Server Settings.
9. Edit the AR Server settings.
    
10. Update Admin Password to the new Mid Tier Administrator password.
     
11. Click Save AR Server.
12. Restart the Mid Tier Tomcat service.

_{Back to top}

Changing the BMC Network Automation sysadmin password

Changing the BMC Network Automation sysadmin password involves two separate procedures:

• Changing the sysadmin user password in BMC Network Automation.
• Updating the password either in the CLM Admin Console's Providers workspace for the BMC Network Automation provider.

To change the sysadmin password in BMC Network Automation

1. Go to the BMC Network Automation URL.
   For example: 
   https://bnaServer:11443/bca-networks
2. Log on as sysadmin using the current credentials.
3. Click Change Password.
   
4. Enter the correct Old Password.
5. Enter and confirm the New Password.
6. Click Submit.
7. Log out of the BMC Network Automation console and then log back in to make sure that your new password works properly. 

To change the sysadmin password in the Providers workspace

1. Log on to the BMC Cloud Lifecycle Management – Administration Console with cloud administrator credentials.
2. Select Workspaces > Providers. 
3. Select Network.
4. Select BBNA, and then click Edit. 
5. Update the sysadmin password, and then click Submit.
    
6. Review the success message, and then click OK. 
   The providers.json file is automatically updated with an encrypted version of the new password. 
    
7. (optional) Restart the Platform Manager CSM service. 

_{Back to top}

To change the Demo password in the BMC Network Automation integration with CMDB

1. Go to the BMC Network Automation URL.
   For example: 
   https://bnaServer:11443/bca-networks
2. Log on as sysadmin using the current credentials.
3. Click the Admin tab. 
4. Under System Admin, select System Parameters. 
5. Scroll down the page to External Integrations.
6. In the Enable CMDB Integration section, change the Demo password if you have changed the AR Demo password.
    
7. Click Save.
   

_{Back to top}

To change the BMC Network Automation Database password

If you have changed the BMC Network Automation database user password on the database server, use the following steps to change the Oracle or SQL Server database password that is saved on BMC Network Automation server.

Before you begin, you need:

• The administrator or root password for the BMC Network Automation server
• The new Oracle or SQL Server database password

To change the database password:

1. Log on to the BMC Network Automation server as an Administrator or root.
2. Generate an encrypted product password:
   1. Open a command window.
   2. Navigate to C:\Program Files\BMC Software\BCA-Networks\utility. 
   3. Run the BcanMaintenanceTool utility.
      For example: 
      BCAN_HOME\utility\BcanMaintenanceTool.cmd
   4. On the Encrypt tab, enter the password in the Password and Confirm Password fields.
       
   5. Choose Encrypt Product Password from the drop-down menu.
   6. Click Encrypt.
      The encrypted password is displayed in the following format:
      ac612b97ad6c4e1f234bcd4896dde0a6 
   7. Copy the encrypted string to the clipboard.
3. Open the BCAN_DATA\database.properties file in a text editor.
   On Windows, this file is located by default at C:\BCA-Networks-Data.  

4. Locate the line that begins with javax.jdo.option.EncryptedConnectionPassword.
   For example:
   

   #are mapping CLOB jdbc type to NCLOB Sql type for Oracle
   versant.jdbcType.1=CLOB,"oracle","NCLOB",-,-,-,-,-
   versant.metadata.0=bcan.jdo
   javax.jdo.option.EncryptedConnectionPassword=754a435f08998af29ce311d3b0f4ef07

    

5. Replace the old hexadecimal string with the new hexadecimal string that you just generated with the BcanMaintenanceTool.
6. Save the file and close the editor.
7. If you are using local authentication, open the BCAN_HOME\tomcat\conf\server.xml file in a text editor.
   On Windows, this file is located by default at C:\Program Files\BMC Software\BCA-Networks\tomcat\conf.  

8. Locate the following lines in the file:
   

         <!-- BEGIN: BCA-Networks realm configured by InstallShield -->
         <Realm className="com.bmc.bcan.catalina.realm.BBNAJDBCRealm"
          driverName="net.sourceforge.jtds.jdbc.Driver"
          connectionURL="jdbc:jtds:sqlserver://172.22.166.16:1433/bna"
          connectionName="bna_user"
          connectionPassword="754a435f08998af29ce311d3b0f4ef07"
          userTable="usr"
          userNameCol="user_name"
          userCredCol="encrypted_password"
          userRoleTable="usr"
          roleNameCol="realm_role_name"
          digest="SHA-256"/>

   
   connectionPassword="d444ce54fe045a01b9a9db77cac3e86a

9. In connectionPassword=, replace the hexadecimal string with the encrypted password that you just generated.
10. Save and close the file.
11. In the BcanMaintenanceTool, generate a silent install configuration file password, but choose Encrypt Silent Install Configuration File Password.
12. Open the BCAN_HOME\BCANInstalledConfiguration.xml file in a text editor.
    On Windows, this file is located by default at C:\Program Files\BMC Software\BCA-Networks. 

13. Locate the lines in the file similar to following example:
    

    <property>
          <name>DATABASE_USER_PASSWORD</name>
          <value>DES\:3d93ab9b35c5deea9d7d64484b0c78fc</value>
    </property>

14. Replace the hexadecimal string with the encrypted password that you just generated.
15. Save the file and close the editor.
16. Restart the BMC Network Automation server.

_{Back to top}

Changing the BMC Server Automation BLAdmin password

Changing the BMC Server Automation BLAdmin password involves two separate procedures:

• Changing the BLAdmin user password in BMC Server Automation.
• Updating the password either in the CLM Admin Console's Providers workspace for the BMC Server Automation provider.

To change the BLAdmin password in BMC Server Automation

1. Log on to the BMC Server Automation Console with the user whose password must be changed (for example, BLAdmin).
2. Select Configuration >SRP Password.
    
3. Enter the correct Old password.
4. Enter and confirm the New password.
    
5. Click OK.
6. Log on to the BMC Server Automation Console and verify that the new password is functioning properly. 

To change the BLAdmin password in the Providers workspace

1. Log on to the BMC Cloud Lifecycle Management – Administration Console with cloud administrator credentials.
2. Select Workspaces > Providers. 
3. Select Compute.
4. Select BBSA, and then click Edit. 
5. Update the BLAdmin password, and then click Submit.
    
6. Review the success message, and then click OK. 
   The providers.json file is automatically updated with an encrypted version of the new password. 
    
7. (optional) Restart the Platform Manager CSM service. 

_{Back to top}

To update the database password in BMC Server Automation

Use the following procedure to change the database password on the BMC Server Automation database. 

1. Launch nsh and run the following commands to set the database password for configuration deployment:

   blasadmin -s config_deployment 
   set database password "******" 

2. Run the commands a second time to set the database password for job deployment:
   

   blasadmin -s job_deployment 
   set database password "******" 

    

3. After the database password is changed, log on to the Bladelogic Application Server Console and verify that you can log on the console.

4. Navigate to the /bin directory from the BMC Service Automation computer.
   For example, on Linux, the directory is /opt/bmc/bladelogic/8.1/operationsManager/NSH/bin/. 
    

   Tip

   From the Windows Start menu, select Programs > BMC Software > BladeLogic Server Automation Suite > Utilities > Application Server Configuration Wizard. 

   
   

5. Run the ./blappconf command from that directory.
    
6. In the Application Server Configuration window, verify that the File Server tab is accessible.
    
7. Click OK.
8. Log on the BMC Server Automation Console.

_{Back to top}

To change Demo password in the BMC Server Automation integration with Atrium CMDB

If you changed the AR Demo password, perform the following actions in the BMC Server Automation Console:

1. Select Configuration > Atrium Integration > Configuration.
    
2. Update the new AR Demo password that you changed earlier.
    
3. Click Test Connection to verify the connection.
   You should see that the CMDB connection is successful. 
    
4. Click Save.

_{Back to top}

To change the password of the AO admin user password

1. Log on to the Atrium Orchestrator Access Manager.
   For example: 
   http://<Your-AO-Server>:<port>/baoam
   http://clm-aus-000000:9090/baoam
   The default login credentials are admin/admin123.
2. Enter the new password in the Password field.
   This must match the password you created if you changed the AO User password previously.
    
3. Click Save.

_{Back to top}

To update the AO Password in the CLM Admin Console configuration

Update the Atrium Orchestrator admin user password under the Storage section in CLM Admin Console's Configuration workspace.
 

1. Open the BMC Cloud Lifecycle Management Administration Console.
2. From Workspaces, select Configuration.  
3. Click the Storage tab. 
4. Change the Atrium Orchestrator password, and then click Save.

_{Back to top}

To update passwords in AO's adapter configurations

If you changed AR's orchestrationuser, BMC Server Automation's BLAdmin, or BMC Network Automation's admin user passwords, you must update the Atrium Orchestrator Adapter settings for the corresponding applications.

1. Log on to the Atrium Orchestrator Grid URL.
   For example:
   http://<Your-AO-Server>:<port>/baocdp
   http://aoServer:28080/baocdp 
   The default login and password is admin/admin123. 
2. Select Manage > Adapters. 
3. Select the appropriate adapter on the grid, and update the password for the connection users.
    

_{Back to top}

Troubleshooting and generating encrypted passwords

1. If you encounter an account lock with the following error, ORACLE ERROR:ORA-28000: the account is locked, perform the following actions:

   SQL> alter user <username> account unlock;
   SQL> commit;

2. If the BMC Server Automation Console Login fails with a connection refuse error, perform the following actions:

1. 1. Verify the encrypted password in the asDataSourceService.xml file.
      This file is located, for example, at /opt/bmc/bladelogic/8.1/operationsManager/NSH/br/deployments/config_deployment/services/asDataSourceService.xml.

      <property name="encryptedPassword">ZXUNNXLAWNAEAWUAENQVVKTNNLLKEXBKWQWZZXKZKVVBNMNOMEZBXBEWBLKETKZM</property>

   2. Use /opt/bmc/bladelogic/8.1/operationsManager/utilities/ ServerAutomationConsoleMaintenanceTool.sh utility to generate encryptedPassword

_{Back to top}

To update Platform Manager JSON with modified AR System server or BAO passwords

If you changed any of the following passwords, use the BMC Customer Support utility (BMC Support Knowledge Article (000031948)) to encrypt new passwords in the Platform Manager JSON in the OSGi server:

• AR System server's CSM Super User password
• AR System server's Demo user password
• Atrium Orchestrator's admin password

To update changed passwords in the JSON:

1. After you encrypt the passwords for CLM Platform's configuration JSON files, log on to the Platform Manager host.
2. Stop the BMC CSM services.
3. Navigate to the /opt/bmc/BMCCloudLifeCycleManagement/Platform_Manager/configuration directory.
4. Edit the cloudservices.json file.

5. To locate the encrypted passwords within the JSONs, search the files for the"isPassword" : true parameter. The first attributeValue after that is a password. The JSON fragment below is an example of how the Super User Password is stored in the JSON. The x+IJYzkzRt8tjHGnMJaJhA== is the part you must change with the new encrypted value for the Super User password.

   {
   "cloudClass" : "com.bmc.cloud.model.beans.AccessAttributeValue",
   "accessAttribute" : {
   "cloudClass" : "com.bmc.cloud.model.beans.AccessAttribute",
   "datatype" : "String",
   "description" : "Super User Password",
   "guid" : "61b995d7-9852-42a0-bf53-6b6f03fd9364",
   "isOptional" : false,
   "isPassword" : true,
   "length" : 255,
   "modifiableWithoutRestart" : false,
   "name" : "password"
   },
   "attributeValue" : "x+IJYzkzRt8tjHGnMJaJhA==",
   "description" : "Super User Password",
   "guid" : "ceb52f5d-c90b-421e-ac1b-985f74240764",
   "name" : "password"
   }

6. As needed, encrypt and change the following user passwords in the JSON files:
   
   • "description" : "Super User Password" = AR System server's CSM Super User password in cloudservices.json
   • "description" : "Database(AR) Server Password" = AR System server's Demo password in cloudservices.json
   • "description" : "Database(AR) Password" = AR System server's Demo Password in cloudservices.json
   • "description" : "Enterprise Database(AR) Password" = AR System server's Demo Password in cloudservices.json
   • "description" : "AO Server Password" = AO admin password
7. After changing the password in JSON files:
   1. Navigate to the <Platform_Manager_installation_directory>\configuration subdirectory and delete the org.eclipse.osgi folder.
   2. Navigate to the <Platform_Manager_installation_directory>\cache subdirectory and delete all files.

   3. Navigate to the <Platform_Manager_installation_directory>\Logs subdirectory and clear all log files.

   4. Restart the BMC CSM service. 
   5. Wait about 5-10 minutes for Platform Manager to propagate the change in the JSON.
   6. Flush the cache on your browser. 
   7. Log on to the BMC Cloud Administration Console as a cloud administrator. 
      Make sure there are no authentication errors.  

_{Back to top}