Home
Modeling software deployment
Modeling software deployment in HCL Launch includes configuring components and component processes and adding those components to applications. Then, you use processes to deploy the components to environments.
Processes
Processes are automated tasks that run on agents.
User impersonation for process steps
HCL Launch can use user impersonation when an agent must run a command for which it might not otherwise have permission, or when a specific user must be employed for a process.
Impersonation on Windows™ systems
For agents that are running on Windows™, HCL Launch provides a program that handles impersonation.

Modeling software deployment
Modeling software deployment in HCL Launch includes configuring components and component processes and adding those components to applications. Then, you use processes to deploy the components to environments.
- Components
  Components represent deployable items along with user-defined processes that operate on them, usually by deploying them.
- Resources
  A resource is a logical deployment target that typically resolves to an agent and a user-defined construct that is based on the architectural model of HCL Launch.
- Applications
  Applications are responsible for bringing together all the components that must be deployed together.
- Application environments
  An environment is a user-defined collection of resources that hosts an application.
- Application templates
  With an application template, you can save and reuse a collection of resources, environments, processes, and tagged components or component templates to create a standardized application.
- Application processes
  Application processes, like component processes, are created with the process editor. You use application processes to deploy or to roll back components.
- Application blueprints
  An application blueprint maps application components to a resource template. When you create an environment or provision one from the cloud, you can use the blueprint as a model.
- Snapshots
  A snapshot is a collection of specific versions of components and processes. Typically, a snapshot represents a set of component versions that are known to work together. In most cases, snapshots include all of the components in an application.
- Creating manual application tasks
  A manual application task interrupts an application process until manual intervention is done. To create a manual task, add a manual step to an application process and select a notification template.
- Approval process
  You can add approval requirements to deployments. Deployments with approvals cannot be completed until all approvers respond. Approvers can respond to requests on the Work Items tab, or by email.
- Inventories
  You use different inventories to track installed components and properties in HCL Launch elements.
- Processes
  Processes are automated tasks that run on agents.
  - Process step types and logic
    When you design processes, you use different kinds of process steps and joining techniques. You can assign properties to process steps and use them to control step execution.
  - Component processes
    A component process is a series of user-defined steps that operate on a component's artifacts. Each component has at least one process that is defined for it and can have several.
  - Application processes
    You can use application processes to deploy or to roll back components.
  - Generic processes
    Generic processes are not specific to a particular component and can be used in any number of applications. They are like general purpose processes. You can use generic processes to download and install packages on the system or perform other configuration management related tasks such as configuring SSH or completing FTP tasks. With a generic process, for example, you can update Linux agents that were recently installed by using SSH to run as a service on a Linux computer. Linux agents cannot be updated in this way during a remote installation.
  - Editing processes
    In the process editor you organize the steps in a process, specify their properties, and connect them to each other.
  - Working on processes in safe edit mode
    Safe editing enables you to test component processes before making them available in normal environments. Make updates to your component process, test those updates safely, and then promote to a new version when you are ready.
  - Running processes
    The way you run a process is different for each type of process.
  - Adding process properties
    A process property provides a way to add user-supplied information to a process. A running process can prompt users for information and then incorporate it into the process. For example, if the process entails authenticating with another server, you can require that a user enter an ID and a password for the process to continue. Properties are defined in the Edit Property dialog box.
  - Copying process steps
    You can copy and paste process steps in all process types: component, application, approval, and generic.
  - Manage process step authentication
    Use token restrictions to manage process step authentication.
  - User impersonation for process steps
    HCL Launch can use user impersonation when an agent must run a command for which it might not otherwise have permission, or when a specific user must be employed for a process.
    - Impersonation on Linux™ and UNIX™ systems
      The su command (as used by HCL Launch) enables a user to start a shell as another user (process steps can be considered individual shells).
    - Impersonation on Windows™ systems
      For agents that are running on Windows™, HCL Launch provides a program that handles impersonation.
    - Impersonation on z/OS® systems
      The su command is used to impersonate users on agent computers that are running IBM® z/OS®.
  - Process steps: Reference
    Application processes, component processes, and generic processes are created with the process editor.
- Statuses
  Create and apply statuses to track component inventory states or to track component versions in environments and resources.
- Properties
  Properties are variables that store information about many different elements, including components, environments, processes, and applications. You can also set global properties for the system.
- Tags
  A tag is a user-defined, shared, short label that you use to classify, view, and conduct operations on objects such as applications, components, agents, and resources.
- Webhooks
  Using the webhooks, you can send text-based responses to users in messaging platform such as MS Teams and Slack when a specific event occurs during deployment process.
- Secret Stores
  Allows HCL Launch to retrieve credentials of individual servers from the Vault and authenticates a plug-in step in the deployment process.

Impersonation on Windows™ systems

For agents that are running on Windows™, HCL Launch provides a program that handles impersonation.

You implement impersonation for agents on Windows™ the same way you do for agents on UNIX™ or Linux™: when you configure a process step, you specify the user credentials that are used when the step is processed. These credentials are the user that the agent is impersonating. In this way, two user accounts are active: the user that the agent runs as normally and the user that the agent is impersonating while it runs the step.

To run steps on Windows™, the agent must be running as LocalSystem as a service or running in an administrator command prompt. Also, this user must have the following privileges, at a minimum:

SE_RESTORE_NAME (Restore files and directories)
SE_BACKUP_NAME (Back up files and directories)
SE_INCREASE_QUOTA_NAME (Adjust memory quotas for a process)
SE_ASSIGNPRIMARYTOKEN_NAME (Replace a process-level token)
The user must also have access to the agent working directory.

Also, to impersonate an administrator, the agent user account must have the SE_TCB_NAME (Act as part of the operating system) permission.

The user that the agent is impersonating must have at least one of the following privileges:

SE_BATCH_LOGON_NAME (Log on as a batch job)
SE_INTERACTIVE_LOGON_NAME (Log on locally)
SE_SERVICE_LOGON_NAME (Log on as a service)

In Windows™ Vista and later versions of Windows™, when the agent logs in as the impersonated user, the operating system returns a restricted token. If the impersonated user is a member of the Administrators group, the agent attempts to get an elevated token. However, if the agent user account does not have the SE_TCB_NAME permission, the agent does not receive an elevated token. In this case, the agent attempts to run the step with the restricted token, but it does not have administrator permissions.

You can also impersonate the Windows™ LocalSystem account. The LocalSystem account is installed on every Windows™ system and is the equivalent of the root user on UNIX™ and Linux™. It always has the privileges that are listed above.

Note: For agents on Windows™, the sudo option is ignored if selected.