On-Premises initial installation using BeyondTrust Password Safe - As an Automation 360 administrator, you can configure BeyondTrust Password Safe integration during the initial Automation 360 On-Premises installation.

Automation 360

As an Automation 360 administrator, you can configure BeyondTrust Password Safe integration during the initial Automation 360 On-Premises installation.

The installer allows you to configure the external key vault connection and retrieve bootstrap credentials for database authentication and service account configuration.

Bootstrap credential retrieval options are available only after you configure the external key vault connection.

Before you begin

  • Obtain the Vault URL for the BeyondTrust Password Safe API endpoint.
  • Obtain the API User Name and API Registration Key used to authenticate with BeyondTrust Password Safe.
  • Required secrets created in BeyondTrust Password Safe for:
    • User account used in Automation 360 Database authentication
    • User account used in Automation 360 Service account authentication
  • SSL certificate available in PEM format. This certificate is optional and is needed only when the installer host does not trust the BeyondTrust Password Safe server certificate.
  • Microsoft SQL Server configured for SQL Server authentication

Procedure

  1. Launch the Automation 360 installer.
  2. Accept the terms and conditions of the Intelligent Automation Agreement and click Next.
  3. Select Custom for full control over installation parameters.
  4. On the External Key Vault Integration page, select BeyondTrust Password Safe.

    BeyondTrust setup

  5. Configure the BeyondTrust Password Safe connection details as follows:

    BeyondTrust configuration page

    Field Description
    Vault URL Provide the BeyondTrust Password Safe API endpoint URL. For example, https://your-hostname.ps.beyondtrustcloud.com/beyondtrust/api/public/v3.
    API User Name Provide the API user name for authenticating with BeyondTrust Password Safe. This is a masked field.
    API Registration Key Provide the API registration key for authenticating with BeyondTrust Password Safe. This is a masked field.
    Password request ID expiry duration (in minutes) Provide the duration in minutes after which the password request ID expires. The default value is 1 minute. Update this value based on your organization’s security and operational requirements.
    Optional Certificate Click this to upload a server certificate in PEM format, if required by your environment. Certificates are optional and are needed only when the installer host does not already trust the BeyondTrust Password Safe server certificate.
  6. Click Next. It will validate the credentials and connect with the BeyondTrust Password Safe.
  7. On the TLS Configuration page, review the default TLS settings and update them as needed for your environment. For more information on TLS Configuration, see Configure application Transport Layer Security.

    TLS Configuration page

  8. Click Next.
  9. On the Service Credentials page, do the following:
    1. Select Service Account (retrieve credentials from external key vault).

      Service account page

      Note: Select this option only if you want to retrieve the Control Room Windows service account credentials from BeyondTrust Password Safe. You can choose other service credential option, such as Local System Account, Service Account (manually enter credentials), or Use a Group Managed Service Account, based on your requirement. For more information, see Configure service credentials.
    2. In the System Name field, provide the managed system name in BeyondTrust Password Safe for retrieving the service account credentials.
    3. In the Account Name field, provide the managed account name in BeyondTrust Password Safe for retrieving the service account credentials.
    4. Click Next.
  10. After the connection is established, you will see the Control Room Service Startup Options page. Select the services you want to automatically run at startup and click Next. For more information, see Select Control Room services to automatically run at startup.
  11. On the Microsoft SQL Server Database page, do the following:
    1. Provide the value for Database Server.
    2. Enter the Name of Control Room database.
    3. Click Next.
  12. On the Database Authentication page, do the following:
    1. Select SQL Server authentication (retrieve credentials from external key vault).

      database authentication page

      Note: Select this option only if you want to retrieve the SQL Server authentication credentials from BeyondTrust Password Safe. You can choose other database authentication option, such as Windows authentication, SQL Server authentication (manually enter credential), or AD Azure authentication (manually enter credential), based on your requirement. For more information, see Configure Microsoft database type and server.
    2. In the System Name field, provide the managed system name in BeyondTrust Password Safe for retrieving the database credentials. Maximum of 255 characters.
    3. In the Account Name field, provide the managed account name in BeyondTrust Password Safe for retrieving the database credentials. Maximum of 255 characters.
    4. Click Next.
  13. On the Provide OpenSearch Credentials page, do the following:
    1. Enter the OpenSearch password.
    2. Re-enter the OpenSearch password for confirmation.
    3. Click Next.
    For more information, see Add OpenSearch credentials.
  14. On the Cluster Configuration page, click Next. For more information, see Configure IP cluster.
  15. On the Ready to Install the program page, click Install to begin the installation.
  16. After the installation is complete, select Launch Automation 360 and click Finish.

Results

After the successful completion of the initial installation, the Automation 360 Control Room can access and retrieve credentials from the BeyondTrust Password Safe.

For detailed steps on installation, see Installing Control Room On-Premises