On-Premises initial installation using Delinea Secret Server - As an Automation 360 administrator, you can configure Delinea Secret Server integration during the initial Automation 360 On-Premises installation.

Automation 360

As an Automation 360 administrator, you can configure Delinea Secret Server integration during the initial Automation 360 On-Premises installation.

The installer allows you to configure the external key vault connection and retrieve bootstrap credentials for database authentication and service account configuration.

Bootstrap credential retrieval options are available only after you configure the external key vault connection.

Before you begin

  • Ensure that the valid OAuth credentials are configured in Delinea Secret Server.
  • Determine the Grant Type that your organization uses to authenticate with Delinea Secret Server: Client Credentials or Password.
  • If you use the Client Credentials grant type, obtain the Client ID and Client Secret used to authenticate with Delinea Secret Server.
  • If you use the Password grant type, obtain the Username and Password for the Delinea Secret Server account used for authentication.
  • Obtain the OAuth token endpoint URL.
  • Obtain the Delinea Secret Server URL that is used to retrieve secrets.
  • Obtain the scope value required by your Delinea Secret Server configuration. This field is optional in the installer.
  • Ensure that the required secrets are created in Delinea Secret Server for:
    • User account used in Automation 360 Database authentication.
    • User account used in Automation 360 Service account authentication.
  • Obtain the SSL certificate available in PEM format. This certificate is optional and is needed only when the installer host does not trust the Delinea Secret Server server certificate.
  • Ensure that the Microsoft SQL Server configured for SQL Server authentication

Procedure

  1. Launch the Automation 360 installer.
  2. Accept the terms and conditions of the Intelligent Automation Agreement and click Next.
  3. Select Custom for full control over installation parameters.
  4. On the External Key Vault Integration page, select Delinea (Thycotic) Secret Server.

    Delinea secret server setup

  5. In the Grant Type field, select Client Credentials or Password.

    For Client Credentials, fill in the following:

    Client credential configuration page

    Field Description
    Token URL Provide the OAuth token endpoint URL. For example, https://your-hostname.delinea.app/identity/api/oauth2/token/xpmplatform.
    Secret Server URL Provide the Delinea Secret Server URL. For example, https://xyz.secretservercloud.com.
    Scope Provide the OAuth scope value. It is an optional field.
    Client ID Provide the client ID.
    Client Secret Provide the client secret.
    Header Provide the HTTP authorization header name. The default value is Authorization.
    Optional Certificate Click this to upload a server certificate in PEM format, if required by your environment. Certificates are optional and are needed only when the installer host does not already trust the Delinea Secret Server certificate.

    For Password type, fill in the following:

    Password type configuration page

    Field Description
    Token URL Provide the OAuth token endpoint URL. For example, https://your-hostname.delinea.app/identity/api/oauth2/token/xpmplatform.
    Secret Server URL Provide the Delinea Secret Server URL. For example, https://xyz.secretservercloud.com.
    Username Provide the username for password-based authentication.
    Password Provide the password for password-based authentication.
    Header Provide the HTTP authorization header name. The default value is Authorization.
    Optional Certificate Click this to upload a server certificate in PEM format, if required by your environment. Certificates are optional and are needed only when the installer host does not already trust the Delinea Secret Server server certificate.
  6. Click Next. Credentials are validated and the connection is established with the Delinea (Thycotic) Secret Server.
  7. On the TLS Configuration page, review the default TLS settings and update them as needed for your environment. For more information on TLS Configuration, see Configure application Transport Layer Security.
    TLS Configuration page
  8. Click Next.
  9. On the Service Credentials page, do the following:
    1. Select Service Account (retrieve credentials from external key vault).

      service account setup

      Note: Select this option only if you want to retrieve the Control Room Windows service account credentials from Delinea Secret Server. You can choose other service credential option, such as Local System Account, Service Account (manually enter credentials), or Use a Group Managed Service Account, based on your requirement. For more information, see Configure service credentials.
    2. In the Delinea (Thycotic) Secret Name field, provide the secret name containing the service account credentials.
    3. Click Next.
  10. After the connection is established, you will see the Control Room Service Startup Options page. Select the services you want to automatically run at startup and click Next. For more information, see Select Control Room services to automatically run at startup.
  11. On the Microsoft SQL Server Database page, do the following:
    1. Provide the value for Database Server.
    2. Enter the Name of Control Room database.
    3. Click Next.
  12. On the Database Authentication page, do the following:
    1. Select SQL Server authentication (retrieve credentials from external key vault).

      Database authentication

      Note: Select this option only if you want to retrieve the SQL Server authentication credentials from Delinea Secret Server. You can choose other database authentication option, such as Windows authentication, SQL Server authentication (manually enter credential), or AD Azure authentication (manually enter credential), based on your requirement. For more information, see Configure Microsoft database type and server.
    2. In the Delinea (Thycotic) Secret Name, provide the secret name containing SQL Server credentials.
    3. Click Next.
  13. On the Provide OpenSearch Credentials page, do the following:
    1. Enter the OpenSearch password.
    2. Re-enter the OpenSearch password for confirmation.
    3. Click Next.
    For more information, see Add OpenSearch credentials.
  14. On the Cluster Configuration page, click Next. For more information, see Configure IP cluster.
  15. On the Ready to Install the program page, click Install to begin the installation.
  16. After the installation is complete, select Launch Automation 360 and click Finish.

Results

After the successful completion of the initial installation, the Automation 360 Control Room can access and retrieve credentials from the Delinea Secret Server.

For detailed steps on installation, see Installing Control Room On-Premises