Work with user names and passwords

The XMLUSER account is the system user account that is used for server-to-server communications and for working with the APIs. If you change the XMLUSER system account password, you must change the value the property, global.xmlservice.login password, to match the new system account password.

1. Log on to UKG Workforce Central as SuperUser
2. Select Setup > System Configuration > System Settings.
3. Click the Global Values tab.
4. Enter the new system account password for XMLUser in the following property:
5. global.xmlservice.login.password
5. Log off UKG Workforce Central.
6. Log on to UKG Workforce Central as XMLUSER, using the original password (not the password you just entered in System Settings).
7. Click the Change Password link.
8. Enter the old password, the new password, and the verification password for xmluser.
9. Log off UKG Workforce Central.
10. Stop and restart the application server.

Impact of XMLUSER password change

If you change the XMLUSER password and your notification server uses the XMLUSER account, you must also change the password for all instances of the notification server. The password must be encrypted.

To encrypt the password, you must first identify the encryption key:

1. Open a command window as an administrator on the application server and navigate to \\Kronos\openfire\ns\conf and open openfire.xml with a text editor.
2. Search for the <random> tag and copy the text between the <random> and </random> tags, for example:
3. <random>6sefm114ntr8dmkelbuwodho2cql</random>
4. This is the encryption key.
3. Close the file.

Next you must run the krencryptNS tool:

Note: UKG Workforce Central also includes a krencrypt tool, which is used when database passwords need to be encrypted for places other than the notification server. Do not use krencrypt to encrypt passwords that are used by the notification server.

1. With the command window still open, navigate to:
2. \\Kronos\configuration\boms\bin
2. Enter the following:
3. krencryptNS password encryptionkey
4. where:
5. password is the notification server password used by XMLUSER.
6. encryptionkey is the encryption key you copied from openfire.xml.
3. Save the encrypted text that the system returns.

Note: If you need to change the encryption key, it must be regenerated and system passwords must be re-encrypted using the new key. See your UKG Representative for a copy of the System Password Management document.

After you have the encrypted password, edit the openfire.xml file for each notification server in your environment:

1. Navigate to \\Kronos\openfire\nsx\conf\
2. where nsx is the name of a notification server, for example ns1, ns2, and so forth.
2. With a text editor, open openfire.xml and replace the password tag with the encrypted password from previous step.
3. <xml>
   <api>
   <username>XMLUSER</username>
   <password>EncryptedPassword</password
   </api>
   </xml>
   
4. where EncryptedPassword is the password that you encrypted in step 1.
3. Save the file and restart the notification server.
4. Repeat steps 1–3 of all notification servers in your environment.

The 4500User account is the system account that is used for device-to-server communications. The user name and new password are case-sensitive.

If you apply a change in the SuperUser account password to the 4500User system account, you must also change the password in the property, global.m8m.login.password, to match the new system account password.

1. In UKG Workforce Central, select Setup > System Configuration > System Settings.
2. Click the Global Values tab.
3. Enter the new system account password for 4500User in the following property:
4. global.m8m.login.password
4. Click Save.

The WBAUser system account is used for Process Manager and Process Designer administration.

If you apply a change in the SuperUser account password to the WBAUser system account, you must also change the password in the property, global.wba.login.password, to match the new system account password for WBAUser.

1. In UKG Workforce Central, select Setup > System Configuration > System Settings.
2. Click the Global Values tab.
3. Enter the new system account password for Process Manager and Process Designer in the following property:
4. global.wba.login.password
4. Click Save.

Impact of password change on Process Designer

If you change the WBAUser account password, you must also change the account information at each client PC where Process Designer is installed and loaded.

To change the password on each client PC:

1. Launch Process Designer, for example, select Start > Programs > Kronos > Process Designer > Kronos Process Designer.
2. In the Process Designer Logon box, enter the URL of the UKG Workforce Central web server as well as the SuperUser user name and password, and then click Options.
3. In the Options box, enter the new password for WBAUser, enter it again to confirm, and then click OK. The password changes immediately.
4. When the Process Designer Logon box returns, click Logon or Cancel.

To change the SuperUser password in online mode:

1. Log on at:
2. http://web_server/instance/navigator/logon
3. where web_server is the name of the machine where the web server software is installed and instance is the name of the instance. The URL is case-sensitive.
2. Enter the default logon with the user name, SuperUser, and the applicable password.
3. Click the Change Password link. The Change Password page opens.
4. Enter the old password, then enter the new password twice.
5. You can also select one or more system accounts, such as Import and XMLUser, and change those passwords as well.
6. Click Change Password Now to save the new password, or click Refresh to reset the page with the password from the database.

Note: As of the release of UKG Workforce Central v8.1.17, the option to log on in offline mode is no longer available.

To change the superuser password in offline mode:

1. Log on to the offline page at:
2. http://web_server/instance/offlineLogon
3. where web_server is the name of the machine where the web server is installed and instance is the name of the instance, typically wfc. The URL is case-sensitive.
2. Enter the default logon with the default user name, superuser, and the applicable password.
3. Select Setup > System Configuration > System Settings.
4. Click the Security tab.
5. Change the site.security.authentication.offline.password value.
6. Click Save.

Make subsequent logins as superuser, using the new password.

Enhance client security:

• Setting Password Save With a Deployment Tool — Simultaneously enable or disable this capability for all the browsers that use your site. Users cannot change this setting.
• For Microsoft Internet Explorer browsers, use the Microsoft Internet Explorer Administration Kit Customization Wizard. Turn on or off the AutoComplete function, then deploy the browsers to user desktops.
• Setting Password Save From User Desktops — If the browsers are already on user desktops, change this setting at each browser. You cannot prevent users from altering the setting.
• For Microsoft Internet Explorer browsers, turn on or off AutoComplete through Tools > Internet Options > Content.

A new link, Forgot your password?, appears on the suite logon page. This link is enabled when the system setting global.security.authentication.question.RequireSecurityQuestions on the Global Values tab is set to True.

Users with security questions and answers must enter their user name before they can use the link to reset their password.

If users leave the User Name text box empty and click Forgot your password?, a Security Question page opens and requires that they enter their user name. If a user does not have a valid user name, the user cannot proceed and must contact a system administrator.

The SuperUser user cannot access the Forgot your password? link.

Security questions enable users to provide answers that identify them to the system when they forget their password. On the Global Values tab in System Settings, you specify the number of questions the user can select and answer. You can use the default questions installed with the system or edit those questions. The system encrypts the answers using the same method used for encrypting passwords. You cannot view or decrypt the answers.

To enable and configure security questions, select Setup > System Configuration > System Settings, click the Global Values tab, and do the following:

1. Change the following setting to true:
2. global.security.authentication.question.RequireSecurityQuestions
3. When you set this property to true, users are required to select their security questions the next time they log on. If they do not select their security questions, they cannot log on.
2. Set the following property to true if you also want to require users to change their security questions when they change their passwords:
3. global.security.authentication.question.SetUpQuestionsAtChangePassword
3. Modify the attributes of the security questions as necessary or leave the default values:
   1. Enter the number of maximum characters allowed for the response (default value is 64 characters):
   2. global.security.authentication.question.MaxNumberOfCharactersInASecurityResponse
   2. Enter the number of consecutive false responses allowed before lock out (default value is 3 false responses):
   3. global.security.authentication.question.MaxNumberOfFalseResponsesToASecurityQuestion
   3. Enter the number of minimum characters allowed for the response (default value is 6 characters):
   4. global.security.authentication.question.MinNumberOfCharactersInASecurityResponse
   4. Enter the number of security questions that will be asked if a user forgets his or her password (default value is 1 question):
   5. global.security.authentication.question.NumberOfQuestionsToAskEnter the
   5. number of security questions that will be available to each user (default value is 3 questions):
   6. global.security.authentication.question.NumberOfSecurityQuestionsPerUser
4. Click Save and close Setup.
5. Run QuickFind, select the applicable group of employees, click Go To, and select People Editor.
   1. Select the Person tab and navigate to User Information.
   2. Select Require password change at the next logon check box.
   3. Click Save.
   4. Repeat step 5 for all selected employees.

When the Security Question Setup page opens, the user selects the questions to answer when the user first logs on, or changes his or her password.

Depending on the system configuration, users can select one or more questions and provide answers. Both are stored in the system. One or more of the questions appear when the user clicks Forgot your password?. The user must provide an answer that matches the answer in the system.

To set up security questions, the user does the following:

1. On the Security Question Setup page, select a question from one of the drop-down lists in the Questions column.
2. Type the answer in the corresponding text box in the Answers column.
3. Repeat steps 1 and 2 until you have selected as many questions as you can.
4. Click:
   • Submit Security Questions to save the changes.
   • Refresh to cancel your changes and start again.