Create OAuth connection - A Control Room administrator can create OAuth connections for users to use these connections in the authentication action for packages without having to enter any authentication details.

Automation 360

A Control Room administrator can create OAuth connections for users to use these connections in the authentication action for packages without having to enter any authentication details.

About this task

The Salesforce mark and logo, the Microsoft SharePoint mark and logo, the Apigee mark and logo, ServiceNow mark and logo, and the Genesys mark and logo are trademarks or registered trademarks of Salesforce, Inc., Microsoft Corp., Google LLC, ServiceNow, Inc., and Genesys, respectively, and are used for identification purposes only.

In the OAuth connection workflow, the Automation 360 server acts as the client when establishing connections to the OAuth server for OAuth connections configured in the Automation 360 Control Room. The Control Room server obtains an access token and a refresh token, as applicable based on the grant type. These tokens are then reused when connecting to the resource server, either from the Control Room server or from the Bot Agent as part of automation. All standard interactions with the OAuth server are managed by the Automation 360 server.

For any external OAuth connections created in the Cloud Control Room instance, all external endpoints such as the authorization URL and token URL must be reachable from the Cloud Control Room through the network perimeter firewall rules. Configure your network firewall to include Automation Anywhere outbound IP addresses to the allowed list. See Control Room IP addresses for external integrations.

Before you begin

  • If the Control Room servers are behind a proxy and external connections have to go through the proxy, then configure forward proxy settings as detailed in Configure forward proxy settings.
  • Ensure that you are using a user role that has the Manage connections permission enabled for the OAuth Connections feature. See Feature permissions for a role.
  • If you are adding more than one scope, ensure that you separate the scopes using commas.

    Example: api,refresh_token,offline_access

  • Ensure that you have configured an enterprise application and made a note of the Client ID, Client secret, Authorization URL, Token URL, and Scope.
    Note:
    • Consider the above prerequisites to avoid a connection error.
    • Although the following table lists the applications that are certified, you can configure your enterprise applications using the Manage > OAuth connections > Create connection by selecting Provider type as Custom.

Examples of key components of OAuth

Enterprise applications Authorization URL Token URL Scope
Azure DevOps https://login.microsoftonline.com/<tenant-id>/oauth2/v2.0/authorize https://login.microsoftonline.com/<tenant-id>/oauth2/v2.0/token https://app.vssps.visualstudio.com/.default
Asana https://app.asana.com/-/oauth_authorize https://app.asana.com/-/oauth_token
  • For project CRUD operations: projects:read, projects:write, projects:delete
  • For task CRUD operations: tasks:read, tasks:write, tasks:delete
  • For comment CRUD operations: stories:read, stories:write
Genesys https://login.<yourinstance>.pure.cloud/oauth/authorize https://login.<yourinstance>.pure.cloud/oauth/token Not required
Google Apigee https://accounts.google.com/o/oauth2/auth?prompt=consent&access_type=offline https://accounts.google.com/o/oauth2/token https://www.googleapis.com/auth/cloud-platform
Google Workspace (Google Calendar, Google Drive, Gmail, Google Sheets) https://accounts.google.com/o/oauth2/auth?prompt=consent&access_type=offline https://oauth2.googleapis.com/token
Jira https://auth.atlassian.com/authorize https://auth.atlassian.com/oauth/token
  • For web triggers: offline_access write:jira-work,read:jira-user,manage:jira-webhook,read:jira-work
  • For actions: read:jira-work,read:jira-user,manage:jira-project,manage:jira-configuration,write:jira-work,write:issue:jira,delete:issue:jira,write:project:jira,delete:project:jira,offline_access
Microsoft Entra (Microsoft 365, Microsoft Office, Microsoft Teams) https://login.microsoftonline.com/<tenant>/oauth2/v2.0/authorize https://login.microsoftonline.com/<tenant>/oauth2/v2.0/token offline_access, openid, https://graph.microsoft.com/.default. For granular scopes, see Scopes and permissions in the Microsoft identity platform

For Microsoft Teams web trigger, add ChannelMessage.Read.All, Chat.Read, Chat.ReadBasic, Chat.ReadWrite, Chat.ReadWrite.All.
Microsoft Entra (SharePoint) https://login.microsoftonline.com/<tenant-id>/oauth2/v2.0/authorize https://login.microsoftonline.com/<tenant-id>/oauth2/v2.0/token
  • For SharePoint actions based on SharePoint REST API, use https://<domain-name>/AllSites.Manage,offline_access,openid
  • For SharePoint web triggers and actions based on Microsoft Graph API, use https://graph.microsoft.com/.default,openid, offline_access.
For granular scopes, see Scopes and permissions in the Microsoft identity platform
Note:
  • Only when your apps require the sub claim in the ID token to identify the end-user, you must include the OpenID scope. Otherwise, this scope is optional.
  • Include the offline_access scope to get a refresh token along with the access token. The refresh token will be used to get a new access token when the current one expires. This avoids sending the user back through sign-in each time.
Okta https://<yourinstance>.okta.com/oauth2/v1/authorize https://<yourinstance>.okta.com/oauth2/v1/token
  • For reading the existing user details, use okta.users.read.
  • For creating new users and to manage all user details, use okta.users.manage.
  • For reading information about groups and their members in your Okta organization, use okta.groups.read .
  • For fetching groups and for adding or removing users to or from a group in your Okta organization, use okta.groups.manage.
Salesforce https://<yourinstance>.salesforce.com/services/oauth2/authorize https://<yourinstance>.salesforce.com/services/oauth2/token
Note: Use HTTPS-only callback.
 Leave blank..
Important: For Salesforce connections, leave the Scope field blank when creating the connection. The OAuth client sends the configured scope value on both the authorization request and the token request, and Salesforce does not support the scope parameter on the token request. Entering a value results in the error scope parameter not supported. Configure the required scopes on the connected app in Salesforce instead.
ServiceNow https://<yourinstance>.service-now.com/oauth_auth.do https://<yourinstance>.service-now.com/oauth_token.do Not required
Zendesk https://<yourinstance>.zendesk.com/oauth/authorizations/new https://<yourinstance>.zendesk.com/oauth/tokens
  • For user CRUD operations: users:read, users:write
  • For ticket CRUD operations: tickets:read, tickets:write
  • For organization CRUD operations: organizations:read, organizations:write

Procedure

  1. In the Control Room, navigate to Manage > OAuth connections.
  2. Click Create connection.
  3. In the Connection settings screen that opens, select a Provider type.
    Note: The Callback URL is used in your enterprise application configuration settings to connect to the Control Room.

    Salesforce (and OAuth providers in general) reject HTTP callback URLs. Therefore, ensure that the Control Room is on HTTPS before configuring the connection.

  4. Enter a unique Connection name to identify the connection.
  5. Optional: Enter a Description for the connection.
    Image displaying the OAuth connection settings page
  6. Click Next.
    The Authentication details screen appears.
  7. Select a Grant type. See OAuth authorization code flow and OAuth client credentials flow.
    Note:
    • If you are configuring for a Google Cloud Platform (GCP) account, select Authorization Code Flow because Control Room managed OAuth connection using Authorization code flow with PKCE is currently not supported.
    • If you are configuring SharePoint web triggers, select Client Credentials Flow.
  8. Enter the Client ID that is provided by the provider for your account.
  9. Enter the Client secret that is provided by the provider for your account.
    Note:
    • The Client secret field supports a maximum of 200 characters.
    • After testing or creating a connection, the Client secret field will not be displayed in the user interface, but the backend service will continue to use the stored value. This is expected behavior.
    • The Client secret field is masked while you enter the value, similar to a password field. This enhances security by preventing the secret from being visible in clear text.
  10. Enter the Authorization URL used to obtain an authorization code for your account.
    Note: For Apigee or Google Cloud Platform (GCP) account, you must append &access_type=offline to the authorization URL. For example: https://accounts.google.com/o/oauth2/v2/auth?prompt=consent&access_type=offline.
  11. Enter the Token URL used to exchange an authorization code for an access token.
  12. Optional: Enter Scope.

    The token expiration time can be set by the identity provider. If the token expires, the Bot uses the offline_access scope to get a new valid token when triggered, based on the details in the Control Room. See Configure OAuth connections in Control Room.

    Image displaying the OAuth authentication details page
    This information is used as claims (information about the user) in an access token and forwarded to the resource server to limit access.
    Note: We recommend that you add the offline_access scope, or appropriate refresh token scope, in the Control Room and when configuring your identity provider so that the access token can be automatically refreshed. Otherwise, you will have to manually refresh the token in the Control Room. See Authenticate user-specific OAuth connections.
    Note: For Salesforce connections, leave the Scope field blank. Salesforce rejects the scope parameter on the token request and returns scope parameter not supported if a value is entered.
  13. Click Next.
    The Test connection and save credentials screen appears.
  14. Optional: Select the Save login credentials.
    Note: Use this option only when you want to generate a shared token that allows users to use this connection without providing user authentication and consent. When you select this option, you must select the Shared token type option when using this connection. See OAuth tokens.
    Note: For Salesforce connections, the token status might show as Not available (Private and Shared). This is expected behavior for Salesforce and does not indicate a connection failure.
  15. Optional: Click Save changes and test connection.
    Image displaying the OAuth test connection and save credentials page
    Note: After you click the Save changes and test connection option and if the connection is successful, the Next button is disabled. Click the Back button, enter the Client secret again, and then click Next. You need not test the connection again unless you have made any changes to the previously provided authentication details.
  16. Click Next.
    The Invite roles screen appears.
  17. Select the roles that you want to invite to use this connection. Only invited roles can use the token in a bot, whether it is private or shared.Image displaying the OAuth invite roles page

    Invite roles action is mandatory if a Bot uses the OAuth connection. This action is optional if an external service will use the OAuth connection.

    Note: Only custom roles are displayed in the list of Available roles.
  18. Click Create connection. An OAuth connection is created.

Example

The following video shows how to create an OAuth connection:

Video showing how to create an OAuth connection

What to do next

Use OAuth connection