You can’t fully automate DB password rotation today using only the supported Configuration Tool command‑line, but you can get close with a hybrid approach. A few important points first:

1. There is no supported way to generate the encrypted passwords for server.hsconf yourself.
   The encryption format/key is internal to OutSystems, so directly editing/encrypting passwords in server.hsconf isn’t supported and may break the environment.

2. The supported procedure still requires Configuration Tool to write the new encrypted values into server.hsconf and to run “Grant Permissions” / “Create Session Database” / “Create/Update Database”. How to change the password of OutSystems database users

Given that, here are the realistic options:

1. Semi‑automation following the supported procedure

You can automate most steps around Configuration Tool, even if the passwords themselves must be entered via the GUI (or at least once, manually).

High‑level automated flow (per environment):

1. Rotate DB passwords on Oracle side
   Use your DB/DevOps tooling to:

   • Change passwords for OSADMIN, OSRUNTIME, OSADMIN_LOG, OSRUNTIME_LOG, OSSTATE (whichever you rotate). How to change the password of OutSystems database users

2. Update passwords in Configuration Tool (deployment controller)
   This step is the blocker for full automation:

   • Today, there is no supported CLI to inject the new passwords.
   • Workaround in practice: treat this as a manual step in the rotation runbook: open Config Tool, update passwords, hit “Grant Permissions”/“Create Session Database” where needed, then “Create/Update Database”, “Export configuration (server.hsconf)”, “Apply and Exit”. How to change the password of OutSystems database users

   You can at least script:

   • Stopping/starting OutSystems services.
   • Backing up the previous server.hsconf.
   • Copying the new server.hsconf to front‑ends.

3. Distribute server.hsconf to front‑ends (fully scriptable)
   On all front‑ends:

   • Stop OutSystems services.
   • Copy the controller’s server.hsconf to C:\Program Files\OutSystems\Platform Server.
   • Start OutSystems services and run Configuration Tool “Apply and Exit” (this last part is still GUI). How to change the password of OutSystems database users

4. Automate the Service Center “Apply Settings” step as much as possible
   The official recommendation is to:

   • Create an “All Components” solution.
   • Apply Settings to ensure all modules pick up new DB credentials. How to change the password of OutSystems database users

   You can:

   • Use Lifetime / Service Center APIs or a small script (e.g. Selenium/Playwright) to automate the “Apply Settings” click on that solution during the rotation window.

This gives you a rotation process where the only non‑automated piece is typing the new password into Config Tool. For many teams, that’s acceptable for a quarterly/annual rotation.

2. Direct editing of server.hsconf (not supported)

To answer your specific question:

can passwords be encrypted and updated directly in server.hsconf and then applied through Configuration Tool?

Technically, server.hsconf is just XML with encrypted values, but:

• The encryption scheme and key are internal.
• There is no public API or documented tool from OutSystems to generate those encrypted blobs.
• Editing the file by hand with your own “encryption” is not supported and can make the environment unusable or unsupported by OutSystems Support.

So this is not a viable workaround if you want to stay within supported boundaries.

3. What you can safely automate today

You can build a script / scheduled job that:

1. Pre‑rotation

   • Notifies admins.
   • Stops OutSystems services on all front‑ends and controller in the correct order.
   • Performs DB backups and copies of server.hsconf.

2. DB password change

   • Executes the Oracle password change (via SQL*Plus, Liquibase, or your preferred tool).

3. Manual step

   • Pause the script and prompt an operator to:
     • Open Configuration Tool on the controller.
     • Enter new passwords.
     • Run “Grant Permissions” / “Create Session Database” / “Create/Update Database”.
     • Export server.hsconf.
     • Click “Apply and Exit”.

4. Post‑Config Tool automation

   • Copy the updated server.hsconf to all front‑ends.
   • Restart services on all servers.
   • Trigger (via API/UI automation) “Apply Settings” for the “All Components” solution in Service Center.

This gets you repeatable automation while still respecting the supported path defined in the documentation. How to change the password of OutSystems database users

4. Recommendation

Given current O11 capabilities:

• Do not try to reverse‑engineer or generate your own encrypted password values in server.hsconf.
• Do:
  • Keep using the official procedure for writing passwords via Config Tool.
  • Wrap everything around it (service control, file copy, DB operations, Service Center apply settings) in scripts, and treat Config Tool as a short manual step in the middle of an otherwise automated process.

If OutSystems ever exposes a supported API/CLI to set DB passwords or generate encrypted values for server.hsconf, that would be the moment to fully automate; until then, any fully automatic approach would be unsupported.