This guide describes the steps to reconfigure on-premises Moveworks Agent deployments for customers without needing to reinstall it from scratch. Whether you’re updating credentials, LDAP details, or REST/Proxy configs, this guide enables you to apply configuration changes with precision.

These Reconfiguration Enhancements have been introduced as part of Agent Version 2.10.4

Please upgrade your agent to the updated version to leverage this guide.

Prerequisites

Ensure that the Moveworks Agent is already installed and running on your on-prem network.
You must have access to the setup_agent.sh script in the Docker/Podman container where the agent is deployed.
Refer to the Moveworks Agent Installation Guide if you need to deploy a new Agent.

How To Initiate the Agent Reconfiguration Process

Via setup_agent.sh Script

You can use the —reconfigure flag to kick off the process :

Log into the VM or Host where the Agent Container is running. You should find the setup_agent.sh in the moveworks_agent folder
Using the —reconfigure flag you can initiate the process

sudo ./setup_agent.sh -r
# or
sudo ./setup_agent.sh --reconfigure

Commands shown with sudo apply to Docker deployments. Omit sudo when using Podman.

You can also use the Interactive Setup Wizard

This uses the same script but allows you to check the existing config.

sudo ./setup_agent.sh --docker
...
Configuration file found. Do you want to set a new configuration? [y/n]: n
Do you want to edit the existing config file? [y/n]: y
...
Starting bond configurator with --reconfigure

Configurations which can be Modified via Reconfiguration

The --reconfigure main menu lists each area by number. [6] Encryption Keys and [7] User Auth REST Configs require agent 2.11.0 or later.

What config do you want to re-configure? [1]Secrets Provider, [2]Moveworks Config, [3]LDAP Configs,
[4]REST Configs, [5]Proxy Configs, [6]Encryption Keys, [7]User Auth REST Configs, [8]Save & Exit, [9]Exit:

Secrets Provider

You can modify values of an existing configured provider (AWS or Azure Secrets Manager). This only applies if a provider was configured at install time.
You cannot switch providers or add a new one via reconfiguration. To add an external secrets provider to an existing deployment, a reinstall is required — see the Installation Guide.

Agent Config Fields

Editable Fields:

auth_url
config_url
access_key
moveworks_access_secret
path_to_cert
proxy_url

LDAP Configuration

Single Host Mode

Reconfiguration options:

Edit existing host configuration
Switch to Forest Mode (optionally retain existing LDAP client config)

Forest Mode

Reconfiguration options:

Add LDAP host
Edit existing host configs
Remove LDAP hosts

Clients are referenced by domain name in Forest Mode. Editable Fields:

host
port
domain
service_user
ldap_service_password
use_ssl
use_starttls
path_to_cert

REST Configs

Add, edit, or remove REST configs. Referenced by service name. Editable fields:

service
header_decorators (add only)
body_decorators (add only)
url_decorators (add only)
do_not_use_rest_proxy
ca_cert_path
max_response_size
use_ntlmv2

Encryption Keys

Add the keys that encrypt employee tokens for user-auth REST configs. The configurator asks for a key ID (an integer from 1 to 4294967295; 0 is reserved) and where the key is stored:

Key source	Behavior
[1] Input base64 key	Paste standard base64 that decodes to exactly 32 bytes, for example the output of `openssl rand -base64 32`. The terminal shows nothing while you type.
[2] AWS Secrets Manager	Read the key from AWS Secrets Manager. Refused unless AWS Secrets Manager is already the agent’s secrets provider.
[3] Azure Key Vault	Read the key from Azure Key Vault. Refused unless Azure Key Vault is already the agent’s secrets provider.
[4] Generate random key	The configurator generates a key and prints it once, after `Generated base64 encryption key (save this securely):`. Copy it into your vault before you continue.

Every agent host for an org must hold the same key under the same key ID, so a second host needs the original key, entered with option [1], or the same secrets manager entry. See encryption_keys.

User Auth REST Configs

Add a connector for a system where employees sign in as themselves with the OAuth2 authorization code grant. The configurator asks for:

the user-auth service name, which must match the Moveworks connector’s On-Premise Service Name
the grant: OAuth2 authorization code
whether the OAuth2 client uses a client secret (answer n for a PKCE public client)
whether to override a user-auth call profile

If no encryption key exists yet, the configurator runs the Encryption Keys prompts first. A service name already configured under REST Configs must be removed there before the configuration can be saved. See user_rest_configs.

Proxy Configs

Add, edit, or remove proxy entries. Each config is tied to a service. Editable fields:

proxy_url
port

Saving and Persisting Configurations

Changes are held in memory until you select [8] Save & Exit at the main menu. Only this option writes agent_config.yml. On agents earlier than 2.11.0, the main-menu Save & Exit option is [6].
A sub-menu’s Save & Exit keeps that sub-menu’s edits in memory and returns to the main menu. A sub-menu’s Exit discards that sub-menu’s edits.
[9] Exit at the main menu discards all edits.

For questions or issues, please reach out to your Moveworks Support Team.