OCLI password encryption: move credentials between environments without reconfiguration
With Orchestration CLI password encryption, you can now export credential definitions with a portable, user-controlled key — importing them into any HCL Universal Orchestrator environment without touching the password fields.
Promoting credential definitions from development to staging — or from an on-premises
deployment to a cloud installation — produced export files with passwords encrypted
under the source system key. The destination environment rejected those fields on import
because each HCL Universal Orchestrator installation uses a unique internal system key. The Orchestration CLI
;password option changes that: exported password fields carry the
{aes-user} prefix encrypted with a key you control, decryptable on
any installation that has the same key.
- One export file that works on any installation
-
Appending ;password to the item specification at export time replaces the system-bound
{aes}prefix with{aes-user}. Because the encryption key is provided by you rather than derived from the installation, the exported file imports without modification into any other HCL Universal Orchestrator environment. The key must be between 8 and 64 characters. - Keep the key out of the terminal, out of the logs
-
Set the
WA_EXPORT_PWDenvironment variable before the export command and Orchestration CLI reads the key without it appearing in the shell history or terminal output. Recommended for automated pipelines and CI/CD setups. For interactive sessions, Orchestration CLI prompts for the key and does not echo it. The inline;password=keyform is available but may expose the key in shell history and is not recommended for production environments. - Backward-compatible import, no existing automation to rewrite
-
On import, Orchestration CLI detects the encryption prefix automatically and applies the appropriate decryption method. Files using the existing
{aes}prefix continue to import without any additional option. Only files that cross environment boundaries need the ;password option at export time. No existing automation scripts require changes unless they handle definitions destined for a different installation.
For the full key provision precedence, supported prefix reference, and command syntax, see Encrypting passwords during model export and import.