BeyondTrust credential retrieval use cases - BeyondTrust Password Safe integration is supported for these use cases.

Use case: Retrieve Control Room system credentials for BeyondTrust Password Safe

1. Set up Active Directory credentials:

   After you complete the initial installation of Automation 360 and configure BeyondTrust Password Safe as the external key vault, you can set up the authentication type for Automation 360 Control Room users in the initial setup as shown below (this occurs directly after the initial installation completes).

   1. From the Authentication type for Control Room users dialog box, click Active Directory.
   2. You can optionally configure the Active Directory integration credential (this is the credential that the Control Room uses to authenticate users with Active Directory) to be retrieved from BeyondTrust Password Safe. Select External Key vault with label BeyondTrust Password Safe.
   3. Enter the System name and Account name.
   4. Click Discover connections or Manually add connections to fetch Active Directory credential from external vault. Once connection is successful, Next button is enabled.
   5. Click Next and configure Owners, Managers, Participants, and Consumers for the locker.
   The Control Room will attempt to retrieve the credential from the BeyondTrust Password Safe and then authenticate to the Domain Controller. If this fails, cause might be one of the following:

   • There is no secret with that name in the BeyondTrust Password Safe
   • There is a secret with that name, but it does not contain a username and password that is authorized for authentication with Active Directory

   You can now log in to the Control Room as admin and add users and roles.

   To change the Active Directory settings,

   1. Log in to the Automation 360 Control Room.
   2. Navigate to: Administration > Settings > Active Directory.
   3. Click External key vault and select BeyondTrust Password Safe.
   4. Enter the System name and Account name to get the Active Directory credentials.
2. Set up SMTP credentials:
   1. To set up email, log in to the Automation 360 Control Room.
   2. Navigate to: Administration > Settings > Email.
   3. Click External key vault and select BeyondTrust Password Safe as the external key vault.
   4. Enter the System name and Account name to get the Active Directory credentials.

Use case: Retrieve auto-login credentials

Auto-login credentials are used to authenticate to an Automation 360 Bot Agent device and start an active Windows Server session. This requires an active Windows Server session to function. Auto-login occurs before automations are launched from a remote Bot Agent device.

To enable auto-login, each automation runtime user must be mapped to a target device. This requires mapping of the Control Room username with the secret names so that during runtime, the Bot Runner user can retrieve the device credentials from the BeyondTrust Password Safe.

Option A: Auto-login under Manage

1. Log in to the Automation 360 Control Room with View external vault and Manage external vault permission.
2. Navigate to Manage > External Vault > Auto Login.
3. Click Add Auto login, Add or + icon.
4. From the Select vault drop-down list, choose one of your vault connections of BeyondTrust provider.
5. Under Auto login, Enabled is selected by default. Click Disabled if you want to disable auto login for this vault connection.

   

   Note: If an user account with unattended Bot Runner license is mapped to an external vault connection and this connection has auto-login disabled, then credentials are retrieved using the device Credential Vault and its stored credentials instead.
6. Click Next to open the Secret mapping page.
7. You can manage secret mappings in two ways - single entry or bulk entries.

   Single entry: Use this method to add a mapping directly in the custom secrets mapping table, without needing a CSV upload.

   1. Click + icon on top of the Secret mappings table.

      

   2. Enter the Username, System name, and Account name.

      

   3. Click Add.
      Note: The system validates whether the entered username exists in the Control Room. If the username does not exist, an error is displayed and the entry is not saved.

   Bulk entries: Use this method to add multiple mappings simultaneously by importing a .CSV template file containing username and secret names mapping entries into the Control Room. You can also use this method for single-entry updates.

   1. Export the CSV file template and add the following entries in the format specified.
      Note: In the Automation 360 On-Premises deployments with Active Directory, prefix the username with domain. Example: domain\username.
   2. Click Import .csv.

      

   3. Browse to select the CSV file template to map the Control Room usernames with the secret names or secret IDs.
      Note: When you upload a CSV file, you can only import up to 100 entries at a time.
   4. Click Import and save. The custom secrets mapping table is populated with the updated entries.
   5. Click Close to return to the list of auto-logins created.

Option B: Auto-login under Settings

Task 1: Map the Control Room username with the secret name

1. Log in to the Automation 360 Control Room with View external vault and Manage external vault permission.
2. Navigate to Administration > Settings > External key vault > Device auto login.
3. Click Edit.
4. Under Configure secrets name, select one of the following: Automation 360 defined secrets naming or Custom secrets naming.
   Automation 360 defined secrets naming: If you've selected this option, click Save changes and skip the below steps for importing the CSV file. The system automatically looks up secrets based on the Automation 360 naming convention. See External key vault naming conventions.

   Note: You can optionally complete the secret mapping steps given below under the Custom secrets naming option if you plan to switch to the Custom secrets naming convention in the future.
   Custom secrets naming: If you've selected this option, do the following:

   1. Select Manage custom secrets mappings.
      Note: The account name that you enter in the Manage custom secrets mappings will be used as the device login username. Account name can be in any of the following formats:

      • sAMAccountName

        For example, CONTOSO\jdoe.

      • UPN

        For example, john.doe@contoso.com.

   2. Download the Custom Secrets Name Mapping Template.csv template and add the following entries in the format specified:
      • Username
      • System name
      • Account name
   3. Click Import .csv and browse to select the Custom Secrets Name Mapping Template.csv template file to map the Control Room usernames with the secret names.
   4. Click Import and save. The custom secrets mapping table is populated with the updated entries.

1. Navigate to Administration > Settings > External key vault > Device auto login.
2. Click Edit.
3. Click Enabled to retrieve the auto-login credentials from that external key vault.
4. Click Save changes to save the configuration.

Use case: Retrieve Agent automation credentials

Automation credentials are variables that developers use in automation (bot) actions. These actions help define and get sensitive data from encrypted storage. The automation uses these credentials to log into applications. During runtime, the Automation 360 Bot Agent retrieves the automation credentials. This use case shows how an automation gets credentials (secrets stored in BeyondTrust Password Safe) and uses them during runtime to log into the applications being automated.

To set up automation credentials retrieval and connect with the BeyondTrust Password Safe, you first need to create a locker and then create credentials.

Audit logs