On-Premises post-installation using Delinea Secret Server - As an Automation 360 administrator, you can configure the Delinea Secret Server On-Premises integration using post-installation method which uses a command-line interactive key vault utility.

Automation 360

As an Automation 360 administrator, you can configure the Delinea Secret Server On-Premises integration using post-installation method which uses a command-line interactive key vault utility.

Before you begin

Ensure that you have set up the Control Room as software within your customer environment. See Installing Control Room On-Premises.

About this task

Before beginning the configuration, review the important messages.

Procedure

  1. When setting up the key vault for On-Premises deployment, you will need to update some values in the keyvault.properties file. To prevent any issues, you must stop the Control Room services:
    1. Automation Anywhere Control Room Messaging service.
    2. Automation Anywhere Control Room service.
  2. Run the key vault utility (crutils.jar) for the Delinea Secret Server key vault configuration:
    1. As a system administrator of the Control Room, you need to access the Automation Anywhere Control Room installation directory. This directory was made when you first installed the Automation 360 product.
      For example: 'C:\Program Files\Automation Anywhere\Automation360'
    2. Download the latest version of the key vault utility (crutils.jar) from the following location:
      1. Open a browser and access the A-People site: A-People Downloads page (Login required).
      2. Click the link to the latest On-Premises build.
      3. Click the Installation Setup folder.
      4. Download the crutils.jar file.
      5. After download, copy the jar file to the Automation 360 installation location: C:\Program Files\Automation Anywhere\Automation360.
    3. Enter the following command to run the key vault utility: jdk11\bin\java -Djavax.net.ssl.trustStore="C:\Program Files\Automation Anywhere\Automation360\pki\trust\store.ks" -Djavax.net.ssl.trustStorePassword=changeit --module-path lib -jar crutils.jar -action UPDATE_KEY_VAULT_CONFIGURATION -configPath "C:\Program Files\Automation Anywhere\Automation360\config"
      • The UPDATE_KEY_VAULT_CONFIGURATION command lets you change the Delinea Secret Server key vault settings. Example: Enter Delinea to connect to the Delinea Secret Server key vault.
      • If there are any trust certificate problems while using the key vault tool to connect to the Delina Secret Server, you need to get the server's certificate and add it to the Automation 360 trust certificate store.> jdk11\bin\java -jar certmgr.jar -appDir . -importTrustCert <Full path of the certificate>
      • The Delinea Secret Server server certificate can be in the .cer, .crt, or .pem format.
      • The certmgr.jar is included in the installation directory for to use.
    4. On the command prompt, enter the following authentication details:
      • Please enter Grant Type: Enter the value client_credentials or password.
      • Please enter Secret Server URL: This is the URL of the Delinea Secret Server vault. For example: https://<tenant domain>.secretservercloud.com
      • Please enter Token URL: This is the URL you use to get access tokens from Delinea Secret Server.

        For the Delinea platform, the URL is: https://<tenant domain>.delinea.app/identity/api/oauth2/token/xpmplatform

        For the Standalone Delinea Secret Server, the URL is: https://<secretserver>/oauth2/token

      • Please enter Scope: Use the value xpmheadless for the Delinea platform. For standalone, it's optional.
      • Please enter HTTP Header Name: Enter the header name that the vault expects to fetch credentials. This header is used to pass access tokens to get the credentials. Specify the default value Authorization if no specific header name is needed.
      • Please enter Client ID: This is the username of the service user that can access secrets. This is optional for the password grant type.
      • Please enter Client Secret: These are the credentials of the service user that can access secrets. This is optional for the password grant type.
      • Please enter Username: This is applicable for the password grant type only. It's the username of the service user that can access secrets.
      • Please enter Password: This is applicable for the password grant type only. It's the password of the service user that can access secrets.

    A configuration success message is displayed:

    Connection configurations valid

    Key Vault configurations successfully updated

  3. To double-check, you can manually look at the entries in keyvault.properties file. This file is found in the C:\Program Files\Automation Anywhere\Automation360\config directory. The following example shows a client_credentials grant configuration:
    Example:
    keyvault.type=DELINEA_SECRET_SERVER
keyvault.delinea.password.encrypted=true
keyvault.delinea.http.header.name=Authorization
keyvault.delinea.token.url=https://demo-xxxx.xxxx.app/identity/api/oauth2/token/xpmplatform
keyvault.delinea.oauth.scope=xpmheadless
keyvault.delinea.oauth.grant.type=client_credentials
keyvault.delinea.secret.server.url=https://demo-xxxx.xxxx.com
keyvault.delinea.oauth.client.id=<sample client Id>
keyvault.delinea.oauth.client.secret=<encrypted value>
  4. Restart the following Control Room services:
    1. Automation Anywhere Control Room Messaging service.
    2. Automation Anywhere Control Room service.