Delinea Secret Server credential retrieval use cases - You can retrieve Delinea Secret Server credentials for several use cases. Some are supported for Automation 360 Cloud deployments, while others are supported for Automation 360 On-Premises deployments.

Use case: Retrieve Control Room system credentials for Delinea Secret Server

Note: This use case applies to On-Premises deployments only.

If you set up a Delinea Secret Server using the key vault utility after installing it, you can then use the Automation 360 user interface to set up Active Directory (AD) and SMTP credentials.

Set up Active Directory credentials:
1. For a new installation, configure the first Administrator to use Active Directory.
2. Choose the Delinea Secret Server (external key vault) to get the AD username and password.
3. Specify the secret name to get the AD credentials.
4. To change the AD settings, log in to the Automation 360 Control Room as the Administrator.
5. From the Control Room, navigate to: Administration > Settings > Active Directory.
6. Select Delinea Secret Server and enter the secret name to get the AD credentials.
Set up SMTP credentials:
1. To set up email, navigate to: Administration > Settings > Email.
2. Choose Delinea Secret Server as the external key vault and enter the secret name to get the SMTP credentials.

Use case: Retrieve Agent auto-login credentials

Note: This use case is supported for both Automation 360 Cloud deployments and Automation 360 On-Premises deployments.

This use case explains how Automation 360 retrieves and uses credentials to start automation on specific Automation 360 Bot Agent devices.

Auto-login credentials are used to authenticate to an Automation 360 Bot Agent device and begin an active Windows Server session. This needs an active Windows Server session to function. Auto-login happens before automation are started from a remote Bot Agent device.

Note: In Automation 360 v.41 and later, device auto-login configuration is available through only one of the following paths, depending on the features enabled for your environment:

If the Manage > External Vault option is visible, configure device auto-login using this flow. This flow supports configuring auto-login for a selected external vault connection in environments that use one or more external vaults. See Option A: Auto-login under Manage given below.
If not, configure device auto-login using Administration > Settings > External key vault > Device auto login. See Option B: Auto-login under Settings given below.

Option A: Auto-login under Manage

Enable the device auto login settings to retrieve auto-login credentials from Delinea Secret Server and map the Control Room username with the secret name:

Note: In a multi-vault setup, each user account with unattended Bot Runner license can be mapped to only one vault connection where its credentials are stored. If no explicit mapping exists, the system checks for a connection with Automation 360 naming enabled or an updated connection. If neither is found, it falls back to device credentials. Ensure that each user account with Bot Runner license is mapped to the correct vault connection.

Log in to the Automation 360 Control Room with View external vault and Manage external vault permission.
Navigate to Manage > External Vault > Auto Login.
Click Add Auto login, Add or + icon.
From the Select vault drop-down list, choose one of your vault connections of Delinea provider.
Under Auto login, Enabled is selected by default. Click Disabled if you want to disable auto login for this vault connection.
Note: If an user account with unattended Bot Runner license is mapped to an external vault connection and this connection has auto-login disabled, then credentials are retrieved using the device Credential Vault and its stored credentials instead.
Click Next to open the Secret mapping page.
You can manage secret mappings in two ways - single entry or bulk entries.
Single entry: Use this method to add a mapping directly in the custom secrets mapping table, without needing a CSV upload.
1. Click + icon on top of the Secret mappings table.
2. Enter the Username, Secret name, and Secret id.
3. Click Add.
  Note: The system validates whether the entered username exists in the Control Room. If the username does not exist, an error is displayed and the entry is not saved.
Bulk entries: Use this method to add multiple mappings at once by importing a .CSV template file containing username and secret names mapping entries into the Control Room. You can also use this method for single-entry updates.
1. Export the CSV file template and add the following entries in the format specified:
  - Username:
    - In a non-Active Directory (AD) environment, enter the Automation 360 username for the Bot Runner. For example, if the Bot Runner name is botrunnertest, the username in the CSV should match.
    - (Applicable for On-Premises only) For an AD environment, add the domain name in the username. For instance, if the AD domain is TESTDOMAIN and the Bot Runner's name is botrunnertest, the username in the CSV should be TESTDOMAIN\botrunnertest.
  - Secret Name: from Delinea
  - Secret ID: Numeric value from Delinea
    Note:
    
    If you only give the Secret Name, the system will first find the Secret ID for that name. Then, it will use the Secret ID to look up the secret. If there are duplicate Secret Names, the system will choose the first one from the list of Secret Namesreturned by the Secret Server.
    
    If you provide both the Secret Name and the Secret ID, the system will use the Secret ID.
    
    If you only have the Secret ID, it will be used to get the secret credential.
2. Click Import .csv.
3. Browse to select the CSV file template to map the Control Room usernames with the secret names or secret IDs.
  Note: When you upload a CSV file, you can only import up to 100 entries at a time.
4. Click Import and save. The custom secrets mapping table is populated with the updated entries.
5. Click Close to return to the list of auto-logins created.

Option B: Auto-login under Settings

Note: Use this option only if Manage > External Vault path is not visible.

Task 1: Map the Control Room username with the secret name

Log in to the Automation 360 Control Room with View external vault and Manage external vault permission.
Navigate to Administration > Settings > External key vault > Device auto login.
Click Edit.
Under Configure secrets name, select one of the following: Automation 360 defined secrets naming or Custom secrets naming.
Automation 360 defined secrets naming: If you've selected this option, click Save changes and skip the below steps for importing the CSV file. The system automatically looks up secrets based on the Automation 360 naming convention. See External key vault naming conventions.
Note: You can optionally complete the secret mapping steps given below under the Custom secrets naming option if you plan to switch to the Custom secrets naming convention in the future.
Custom secrets naming: If you've selected this option, do the following:
1. Select Manage custom secrets mappings.
2. Export the CSV file template and add the following entries in the format specified:
  - Username:
    In a non-Active Directory (AD) environment, enter the Automation 360 username for the Bot Runner. For example, if the Bot Runner name is botrunnertest, the username in the CSV should match.
    
    (Applicable for On-Premises only) For an AD environment, add the domain name in the username. For instance, if the AD domain is TESTDOMAIN and the Bot Runner's name is botrunnertest, the username in the CSV should be TESTDOMAIN\botrunnertest.
  - Secret Name: from Delinea
  - Secret ID: Numeric value from Delinea
    Note:
    
    If you only give the Secret Name, the system will first find the Secret ID for that name. Then, it will use the Secret ID to look up the secret. If there are duplicate Secret Names, the system will choose the first one from the list of Secret Namesreturned by the Secret Server.
    
    If you provide both the Secret Name and the Secret ID, the system will use the Secret ID.
    
    If you only have the Secret ID, it will be used to get the secret credential.
3. Click Import .csv and browse to select the CSV file template to map the Control Room usernames with the secret names or secret IDs.
  Note: When you upload a CSV file, you can only import up to 100 entries at a time.
4. Click Import and save. The custom secrets mapping table is populated with the updated entries.

Task 2: Enable device auto-login from Delinea Secret Server

Note: You cannot enable auto-login for specific unattended Bot Runners by providing device credentials for them. Once key vault is configured, credentials for all unattended Bot Runners will be retrieved from the key vault. Make sure that each Bot Runner’s credentials are stored in the key vault to avoid a Secret not found error.

Navigate to Administration > Settings > External key vault > Device auto login.
Click Edit.
Click Enabled to retrieve the auto-login credentials from that external key vault.
Click Save changes to save the configuration.

Use case: Retrieve Agent automation credentials

Note: This use case is supported for both Automation 360 Cloud deployments and Automation 360 On-Premises deployments.

Automation credentials are variables that botdevelopers use in automation (bot) actions. These actions help define and get data from encrypted storage. The automation uses these credentials to log into applications. During runtime, the Automation 360 Bot Agent retrieves the automation credentials. This use case shows how an automation (bot) gets credentials (secrets stored in Delinea) and uses them during runtime to log into the applications being automated.

To set up automation credentials retrieval and connect with the Delinea Secret Server, you first need to create a locker and then create credentials.

Note: If you want to store credentials in the Control Room credential vaults and external key vaults, do the following:

Create separate lockers in the Control Room to store credentials created in the Control Room credential vaults.
Create separate lockers in the Control Room to store credentials created in external key vaults.

The Control Room does not support storing credentials from the Control Room credential vaults and external key vaults in the same locker.

In Automation 360 v.41 and later, credential and locker management for external vaults are available through either of the following options, depending on the features enabled for your environment.

If the Manage > External Vault option is visible, use this flow for all external vault related activities, including creating and managing lockers and credentials. This flow is designed for environments that use one or more external vaults. See:
- Manage lockers for an external key vault connection
- Manage credentials for an external key vault connection
If not, use the Manage > Credentials flow to create lockers and credentials. See:
- Create locker
- Create credential

Note: When Manage > External Vault is visible, the Manage > Credentials option remains visible too. However, external vault related credential and locker creation options are no longer available through the Manage > Credentials flow.

Use case: Retrieve Control Room bootstrap credentials for Delinea Secret Server

Note: This use case applies to On-Premises deployments only.

The Automation 360 Control Room uses bootstrap credentials to access supporting services such as database. You configure these credentials during post-installation (using the key vault utility) by specifying the secret name.

When required during the bootup sequence or normal operations (such as refreshing a database authentication), the Control Room uses the key vault connection to retrieve the credential and perform the required authentication.

Note:

Retrieving bootstrap credentials from an external key vault might cause the Control Room to fail if the external key vault is not accessible during boot-up, or if the external key vault is not accessible when the Control Room refreshes database connections.
You must select the Microsoft SQL Server Authentication for this use case; other database authentication methods are not supported for bootstrap.

When you need to get a database credential from the Delinea Secret Server, use the key vault utility called (crutils). Follow these steps:

First, stop these services to avoid any issues:
- Control Room service
- Automation Anywhere Control Room Messaging service
- Automation Anywhere Control Room service
Open the command prompt as an Administrator. Go to the Automation 360 installation location. Run the crutils utility with this command:
jdk11\bin\java -Djavax.net.ssl.trustStore="C:\Program Files\Automation Anywhere\Automation360\pki\trust\store.ks" -Djavax.net.ssl.trustStorePassword=changeit --module-path lib -jar crutils.jar -action UPDATE_DB_AUTHENTICATION_CONFIGURATION -configPath "C:\Program Files\Automation Anywhere\Automation360\config”
1. After the utility loads the current database configuration, you will see this prompt:
```
Database authentication configurations loaded
 Currently configured database authentication [SQL]
Change database authentication. Available options:
 WINDOWS: Connect to database using windows authentication
 SQL: Connect to database using SQL server authentication, manually enter username and password
 KEY_VAULT: Connect to database using SQL server authentication, retrieve username and password from external key Vault
Enter database authentication [WINDOWS/SQL/KEY_VAULT]:
 Enter KEY_VAULT
```
2. Enter the Secret name which contains the database credentials.
3. The key vault utility will run. If the database configuration is successful (meaning it connects to the Delinea Secret Server, retrieves the designated credential, and uses it to connect to the database), you will see these messages on the console:
```
Database Credentials are valid
Database authentication configurations successfully updated
```
Finally, restart these services:
- Control Room service
- Automation Anywhere Control Room Messaging service
- Automation Anywhere Control Room service