Command-Line Interface Commands for Omnissa Access

After a successful Omnissa Access deployment, use the CLI to manage and maintain your environment.

The CLI supports day-to-day administrative tasks including validating configuration, initializing and updating tenant settings, rotating certificates, checking service readiness, running health checks, collecting logs, restoring backups, updating operating system packages, and managing services on the Omnissa Access control plane.

Commands are organized into groups by administrative area:

• wso access — Manage Omnissa Access tenant and SMTP configuration.
• wso control-plane — Deploy, validate, update, restore, and maintain Omnissa Access control plane components.
• wso services — Deploy, restore, snapshot, and manage service-level operations.
• wso healthcheck, wso validate-log-config, and related commands verify deployment health and configuration.

The following table lists the available CLI commands with a brief description of each.

wso Commands

Note: Run wso commands from the cluster folder (/opt/wss/<cluster_name>) unless a command's help text says otherwise.

• wso

  Root command for the Omnissa Access CLI. Run wso --help to display all available commands and their usage.

• source <(wso completion bash)

  Enables auto-complete in current terminal session. You must run the source <(wso completion bash)command whenever you initiate a new terminal session.

• wso access

  Manages Omnissa Access installation and configuration.

  wso access add-tenant-admin-users: Adds an admin user to an Access tenant.

  wso access bootstrap: Loads the Access profile, validates certificates, generates environment variables, and syncs key-value data and secrets.

  wso access check-service-readiness: Checks the readiness of Access services.

  wso access configure-cert-proxy: Configures cert-proxy for Access cluster

  wso access create-admin-client: Creates an admin OAuth2 client in a tenant

  wso access create-tenant: Creates the first Access tenant. This is a one-time command, already executed during installation.

  wso access init: Initializes the working directory for Omnissa Access installation. This command was already executed during installation.

  wso access push-notifications: Command to manage push notifications in Hub services.

  wso access rate-limit set: Sets rate limits for Omnissa Access, with the following flags:

  • --login_rpm - rate limit for login requests
  • --launch_rpm - rate limit for launch requests
  • --wsfed_rpm - rate limit for WS-Fed requests

  wso access rate-limit get: Gets the current rate limit settings for Omnissa Access.

  wso access reset-admin-password: Resets a tenant admin user's password.

  wso access rotate-certificate: Rotates Access certificates (FQDN or cert-proxy).

  wso access smtp: Initializes, updates, fetches, and validates SMTP configuration.

  wso access smtp init: Initializes SMTP for sending mail.
  wso access smtp update: Updates SMTP parameters for sending mail using an SMTP server.
  wso access smtp get: Gets SMTP parameters for sending mail using an SMTP server.
  wso access smtp validate: Validates SMTP parameters for sending mail using an SMTP server.

  wso access update-config: Reconcile Access platform Consul KV and Vault config during upgrade

  wso access validate: Validates the Access cluster inventory file and prerequisites.

• wso configure

  Configures the CLI to use a specific version of Omnissa Access components.

• wso control-plane

  Deploys and manages Omnissa Access control plane components. Use wso cp as a shorthand alias for this command.

  wso control-plane ansible: Runs arbitrary Ansible commands against the control plane cluster.

  wso control-plane collect-log-bundle: Collects offline logs from cluster nodes into a bundle.

  wso control-plane deploy: Deploys Omnissa Access control plane components.

  wso control-plane diagnostics: Runs diagnostics on the nodes in the Omnissa Access control plane.

  wso control-plane hydrate-assets: Adds the latest assets.

  wso control-plane plan-restore-backup: Plans the restore of configuration and key-value data from backup to the Omnissa control plane.

  wso control-plane precheck: Verifies whether the cluster configuration satisfies the deployment requirements.

  wso control-plane reset-assets: Cleans up old assets and resets to the latest assets.

  wso control-plane restart-schedulers: Restarts the service scheduler agents in the Omnissa Access cluster.

  wso control-plane restore-backup: Restores configuration and key-value data from backup to the Omnissa Access control plane.

  wso control-plane sync-time: Syncs time on the Omnissa Access control plane virtual machines.

  wso control-plane unseal: Unseals the Vault nodes in the Omnissa Access control plane.

  wso control-plane update-agents: Upgrades agent versions or updates the configuration of Omnissa Access control plane components on agent virtual machines.

  wso control-plane update-certificate: Updates certificates for Omnissa Access control plane services.

  wso control-plane update-os: Updates packages on each Omnissa Access control plane Linux node.

  wso control-plane update-telemetry: Updates telemetry on each Omnissa Access control plane node.

• wso cp

  Alias for the wso control-plane command. Accepts all of the same subcommands.

• wso eula

  Displays the EULA and allows accept/reject.

• wso healthcheck

  Runs a basic health check on the control plane, including core platform components and services running on top of it.

• wso services

  Deploys and manages services on the Omnissa control plane.

  wso services config-report: Reports the configurations and overrides in use.

  wso services deploy: Deploys services on the Omnissa control plane.

  wso services list: Displays settings for a given service.

  wso services restore: Restores services on the Omnissa control plane.

  wso services restore-complete: Verifies the restored data and enables backup operations on the newly promoted primary cluster.

  wso services set-log-level: Sets the log level for a given service.

  wso services snapshot: Snapshot services on Omnissa Access Control Plane.

  wso services sync-kv: Syncs to the key-value store from a local file system directory.

  wso services sync-secrets: Syncs to the secret store from a local file system directory.

  wso services temp-creds-generate: Generates temporary credentials for a service.

  wso services temp-creds-revoke: Revokes temporary credentials for a service.

• wso validate-log-config

  Validates logging configuration (syslog, Loki, OpenSearch) and checks reachability.

• wso version

  Displays the version of the CLI.

access-wizard Commands

Initial deployment (Bootstrap node setup through tenant creation) can be performed with the guided access-wizard command instead of running wso commands directly. See Phase 3, Option 1 - Deploy Omnissa Access Using the Access Wizard for the full guided deployment procedure, or Phase 3, Option 2 - Deploy Omnissa Access Manually to run the wso commands documented above directly. After an access-wizard deployment, use these access-wizard commands for common Day-2 tasks. access-wizard deploy, resume, and support-bundle are documented in Phase 3, Option 1 - Deploy Omnissa Access Using the Access Wizard instead, since they're used in the context of the guided deployment itself. For anything not covered here, use the wso commands documented above.

Note: The access-wizard commands only work if the deployment was completed using the Access Wizard.

• access-wizard --help: Show a list of available access_wizard commands.

• access-wizard status: Shows the status of each deployment stage.

• access-wizard configure: Reopens the Section 6 (Optional Services) questions, SMTP, NTP, NFS shared storage, and Cert-Proxy, to configure or change them after deployment.

• access-wizard show-tokens: Displays the Nomad, Consul, and Vault URLs and access tokens. Requires an interactive terminal and confirmation.

• access-wizard credentials: Validates the shared configuser password against every node in the cluster.

• access-wizard verify-control-plane: Validates the health of Control Plane platform services.

• access-wizard docs: Displays a list of Omnissa Access documentation URLs.

Common Administrative Tasks

The following examples show how to use frequently needed CLI commands after deployment.

Generate a Log Bundle

Use wso control-plane collect-log-bundle to collect offline logs from all cluster nodes into a single bundle for troubleshooting. By default, this scans the current directory for the cluster inventory file; pass a working directory as an argument to run it from elsewhere.

wso cp collect-log-bundle

Logs are saved under /tmp/.

Reset Tenant Admin Password

Sends a password reset email to the user by default; use --send_mail=false to skip it. The domain defaults to System Domain unless --domain is specified.

wso access reset-admin-password

Create the First Access Tenant

wso access create-tenant

Unseal Vault Nodes

Use wso control-plane unseal if Vault becomes sealed after a maintenance operation such as a node reboot. By default, this scans the current directory for the control plane inventory file; pass a working directory as an argument to run it from elsewhere.

wso cp unseal

Run Diagnostics

Use wso control-plane diagnostics to run diagnostics on the nodes in the control plane.

wso cp diagnostics

Restore Configuration from Backup

Use wso control-plane restore-backup to restore configuration and key-value data to the control plane. This requires a restore plan that has already been created and verified using plan-restore-backup. By default, this scans the current directory for the control plane inventory file; pass a working directory as an argument to run it from elsewhere.

wso cp restore-backup

Check Service Readiness

Use wso access check-service-readiness to verify that Access services are ready. Check all services, or a specific one by name.

wso access check-service-readiness
wso access check-service-readiness --service_name saas

Create an Admin OAuth2 Client

Use wso access create-admin-client to create an admin-scoped OAuth2 client in a tenant, for authenticating against the ACS API. Run this after tenant creation. The client secret is displayed only once, so store it securely.

wso access create-admin-client --client_id my-admin-client

Run a Health Check

Use wso healthcheck to run a basic health check on the control plane, including core platform components and the services running on top of it. Output defaults to table format; use -f json for machine-readable output.

wso healthcheck

Add -n/--include_node_stats to include node stats in the output (this increases execution time).

Add a Tenant Admin User

Use wso access add-tenant-admin-users to add an admin user to an existing tenant.

wso access add-tenant-admin-users --admin_username admin --admin_email admin@example.com

Configure SMTP

Use the wso access smtp commands to initialize, update, fetch, and validate SMTP settings for outgoing mail.

wso access smtp init
wso access smtp update --SMTP_HOST smtp.example.com --SMTP_PORT 587 --SMTP_USER user --SMTP_PASSWORD ****** --SMTP_SECURITY_TYPE TLS
wso access smtp get
wso access smtp validate

Set Rate Limits

Use wso access rate-limit set to set the maximum login, launch, and WS-Fed requests allowed per minute. Use wso access rate-limit get to view the current limits.

wso access rate-limit set --login_rpm 100 --launch_rpm 100 --wsfed_rpm 100
wso access rate-limit get 

Rotate a Certificate

Use wso access rotate-certificate to rotate the FQDN or cert-proxy certificate. Provide only the certificate and key file names (not a path), as found in /opt/wss/<cluster_name>/access/certs.

wso access rotate-certificate --cert_type fqdn --cert_file cert.pem --key_file key.pem

Configure Cert-Proxy

Use wso access configure-cert-proxy to configure cert-proxy as a Day-2 operation on an existing Access deployment. --ssl_certificate_path and --ssl_certificate_key are required only when --ssl_certificate_type is CUSTOM_CERT; they aren't needed for FQDN_CERT.

wso access configure-cert-proxy --ssl_certificate_type CUSTOM_CERT --ssl_certificate_path cert.pem --ssl_certificate_key key.pem

Set a Service Log Level

Use wso services set-log-level to change the log level for a given service. By default, this scans the current directory for the configuration; pass a working directory as an argument to run it from elsewhere. If --log-level isn't specified, the service's own default log level is used.

wso services set-log-level --service <service-name> --log-level debug

Validate Logging Configuration

Use wso validate-log-config to validate logging configuration (syslog, Loki, OpenSearch) and check reachability.

wso validate-log-config