Changing key IBM Workload Scheduler passwords

About this task

When you change passwords for key users in your IBM Workload Scheduler environment, there are various operations to perform, depending on which user's password is being changed, the type of operating system on which it is deployed, and the type of IBM Workload Scheduler node where the password is being changed.

Perform one or more of the following steps depending on the characteristics of your environment and your operating systems:

Change the user password at the operating system level using native commands.
If you use special characters in the password, ensure you use a "\" (backslash) before the special character. The following rules apply:

On Windows™ operating systems:

Passwords for users can include any alphanumeric characters and ()!?=^*/~[]$_+;:.,@`-#.

On UNIX™ and LINUX systems:

Passwords for users can include any alphanumeric characters and ()!?=*~_+.-.
Change the password for the TWS user by changing the WebSphere Application Server Liberty user password. For more information, see the WebSphere Application Server Liberty documentation, for example securityUtility command. For the detailed procedure, see Changing the WebSphere Application Server Liberty password.
Change the password used by command-line clients, as described in Change password used by command-line clients to access the master domain manager.
Change the password used by fault-tolerant agents, as described in Change password used by fault-tolerant agent systems to access the master domain manager (for conman).
Change the password for the database user, as described in Changing the properties for the database.
Change the engine connection parameters in the Dynamic Workload Console, as described in Update the engine connection parameters in the GUIs.
On Windows operating systems, change the password of the IBM® Workload Scheduler account in Windows services, as described in Windows - update Windows services.
If you run jobs on Windows operating systems, change the password of the streamlogon user of the jobs, as described in Change the IBM Workload Scheduler user definition.
Run the following commands to ensure the previous steps were completed correctly:
```
optman ls
```
```
composer mo ws=@
```

For all other users of IBM Workload Scheduler, no action is required if their passwords change.

Note: After changing any password, restart WebSphere Application Server Liberty.

See the following table to determine if a change of password requires actions to be taken for a role on the different IBM Workload Scheduler components. Look up the role and the component and determine from the corresponding table cell where the changes must be made:

If the cell contains a "✓", make the change on the system where the indicated component is running
If the cell contains "MDM", make the change on the master domain manager to which the component belongs

Table 1. If and where password changes are required
Role	MDM	BKM	FTA
WebSphere Application Server Liberty user	✓	✓
Database user	✓	✓
Streamlogon user (Windows®)	✓	✓	MDM

For example, if you are the ˂TWS_user> (the instance owner) of a fault-tolerant agent, you need to implement the password change on the system where the fault-tolerant agent is installed, but if you are also the streamlogon user of jobs running on that system, the changes required for the new password must be applied at the master domain manager to which the fault-tolerant agent belongs.