This topic describes solutions for handling private data, such as credentials, used in automation workflows.
Solution summary
Automation workflows often require private data, such as credentials and AccessKey pairs, to perform tasks like logging in to a webpage or calling a system API to report data. For security, you should avoid hardcoding this data in plaintext within your automation workflow. The following table summarizes our recommendations.
Scenario | Recommended solution |
The private data is static, meaning the workflow uses the same pre-configured data for each run. For example:
| Use the asset variable feature (see Asset variables). This method encrypts and stores the private data on the server-side. The workflow dynamically retrieves the data at runtime without storing it on the local disk. |
The private data is dynamic and user-specific. For example:
| Solution 1: The automation workflow does not handle the login process. Instead, it checks if the target system is already logged in. If not, the workflow ends and prompts the user to log in manually before re-running the workflow. |
Solution 2: Use an input parameter for the workflow (see Use input parameters to create a parameter panel). The user provides the credentials at runtime. Note that if you pass this information in plaintext, the input parameter is stored in the robot's local logs or in the task information on the server-side. Therefore, we recommend encrypting the input parameter. | |
Solution 3: Pass private data to the workflow by using a presigned URL for a file in OSS (see Use a presigned URL). The advantage of this solution is the high security of its OSS integration. The disadvantage is that the end user cannot manually run the workflow in the robot client. This method is designed for scenarios where our product is integrated into your system. | |
Solution 4: The automation workflow dynamically retrieves private data by calling your KMS product. This method requires you to first add the Python library provided by the KMS product (see Reference a third-party library) and then write code to call the KMS product. |
Asset variables
Create asset variables
To create and manage asset variables, go to asset management in the console.
You can create three types of asset variables: Text, Password, and Account and password.
Variable names must be unique within the same enterprise.
Only the creator of an asset variable can grant other users permission to use it.
Use asset variables
The following table summarizes how to use asset variables.
Type | Usage | Code mode | Visual mode |
Text | Read the variable's content for subsequent operations in the workflow, such as writing it to a specific input box. | ||
Password | |||
Account and password | Automatically fill in a webpage. |
When you use an asset variable of the Account and password type, the password can only be entered into a password input field on a webpage (that is, an <input> element with type="password").
When you use an asset variable, the account that runs the automation workflow must have permission to use that asset variable. Otherwise, a permission error occurs at runtime.
Examples
The following example uses the Alibaba Cloud login page.
Using Text and Password asset variables
The two asset variables are configured as follows:
The following example shows the usage in visual mode:
The following example shows the usage in code mode:
page = rpa.app.chrome.create('https://account.aliyun.com/login/login.htm') str_account = rpa.console.asset.get_value('v_account') str_password = rpa.console.asset.get_value('v_password') page.input_text('input_account', str_account, index = 1, replace = True) page.input_text('input_password', str_password, index = 1, replace = True)
Using an Account and password asset variable
The asset variable is configured as follows:
The following example shows the usage in visual mode:
The following example shows the usage in code mode:
page = rpa.app.chrome.create('https://account.aliyun.com/login/login.htm') rpa.console.asset.fill_account_to_page('v_account_password','input_account','input_password',page)
