Identity Server acts as a federation gateway for a series of external identity providers (Google, Windows, Azure AD, SAML2) and it allows you to configure their settings in its External Identity Providers page. Orchestrator's UiPath.Orchestrator.dll.config
file need not be changed to perform external identity provider configurations. Note that users are created within Identity Server's database.
If you are updating Orchestrator to v2020 and you've previously enabled any external identity provider authentication, there are a series of manual configurations to be performed at the external identity provider level. Previously created users are propagated to the Identity Server database.
Important!
Restart the IIS server after performing any configuration changes within Identity Server.
Managing External Identity Providers Settings
Note:
The URLs are case-sensitive. For simplicity, we recommend the use of lower cases whenever possible.
Google OpenID Connect
This section empowers you to set the parameters that allow Orchestrator/Identity Server to use Google OpenID Connect authentication.
Here's an example of such a setup:
Before performing any settings in this page, make sure that you've configured Google to recognize your Orchestrator instance.
Follow the steps here to instruct Identity Server to use Google OpenID Connect authentication.
Windows
This section empowers you to set the parameters that allow Orchestrator/Identity Server to use Windows authentication.
Here's an example of such a setup:
Follow the instructions on this page to enable Windows authentication.
Azure AD
This section empowers you to set the parameters that allow Orchestrator/Identity Server to use Azure AD authentication.
Here's an example of such a setup:
Before performing any settings in this page, make sure that you've configured Azure AD to recognize your Orchestrator instance.
Follow the steps here to instruct Identity Server to use Azure AD authentication.
SAML
This section empowers you to set the parameters that allow Orchestrator/Identity Server to use single sign-on authentication using SAML 2.0.
You can find examples of such setups for the following external identity providers:
ADFS Authentication Using SAML 2.0
Before performing any settings in this page, make sure that you've configured ADFS to recognize your Orchestrator instance.
Follow the steps here to instruct Identity Server to use ADFS authentication.
Google Authentication Using SAML 2.0
Before performing any settings on this page, make sure that you've configured Google to recognize your Orchestrator instance.
Follow the steps here to instruct Identity Server to use Google SAML 2.0 authentication.
OKTA Authentication Using SAML 2.0
Before performing any settings on this page, make sure that you've configured OKTA to recognize your Orchestrator instance.
Follow the steps here to instruct Identity Server to use OKTA authentication.
Manual Configurations on Orchestrator Update
Upon updating to v2020.4, any external identity provider authentication enabled in Orchestrator is automatically migrated to Identity Server, along with all the existing users. However, some manual changes are required on your part, otherwise, the authentication will not work.
Here are the general actions you need to perform:
- Go to the actual external provider's location.
- Modify the Return URL by adding
/identity
after your Orchestrator URL. - Save the changes.
Read on for guidance on the actions needed for specific external identity providers.
Important!
Replace all occurrences of
https://OnPremOrchestrator.domain.com
with the URL of your Orchestrator instance.
Google OpenID Connect Authentication
If you've previously configured Google to recognize a new Orchestrator instance, then you need to perform these steps:
- Access Google APIs and search for your previously created project.
- In the Credentials page, select your previously created OAuth 2.0 Client.
- In the Client ID for Web application page, edit the Authorized redirect URIs value by adding the suffix
/identity
after your Orchestrator URL. For example,https://OnPremOrchestrator.domain.com/identity/google-signin
. - Click Save to save the changes.
Windows Authentication
If you've previously enabled Windows authentication, then no further manual actions are required on your part.
Azure AD Authentication
If you've previously configured Azure AD to recognize a new Orchestrator instance, then you need to perform these steps:
- Access Microsoft Azure App Registrations page and select your previously registered app.
- In the selected app's page, select Redirect URIs.
- In the selected app's Authentication page, modify the Redirect URL by adding
/identity/azure-sign-in-oidc
to your Orchestrator URL.
- Save the changes.
- Restart the IIS server.
SAML2 Authentication
ADFS
If you've previously configured ADFS to recognize a new Orchestrator instance, then you need to perform these steps:
- Open ADFS Management and modify your existing relying party trust for Orchestrator as follows:
- In the Configure URL section, select the Enable support for the SAML 2.0 Web SSO Protocol and fill in the URL of the Orchestrator instance plus the suffix
identity/Saml2/Acs
in the Relying party SAML 2.0 SSO service URL field. For example,https://OnPremOrchestrator.domain.com/identity/Saml2/Acs
. - In the Configure Identifiers section, fill in the URL of the Orchestrator instance plus the suffix
identity
in the Relying party trust identifier field. For example,https://OnPremOrchestrator.domain.com/identity
.
- In the Configure URL section, select the Enable support for the SAML 2.0 Web SSO Protocol and fill in the URL of the Orchestrator instance plus the suffix
- Save the changes.
- Once ADFS is configured, open PowerShell as an administrator and run the following commands:
Set-ADFSRelyingPartyTrust -TargetName "https://OnPremOrchestrator.domain.com/identity" -SamlResponseSignature MessageAndAssertion
(Replacehttps://OnPremOrchestrator.domain.com
with the URL of your Orchestrator instance)Restart-Service ADFSSRV
.
- Restart the IIS server.
Google
If you've previously configured Google to recognize a new Orchestrator instance, then you need to perform these steps:
- Open Google Admin console and modify your existing service's details as follows:
- In the Service Provider window, fill in the URL of the Orchestrator instance plus the suffix
identity/Saml2/Acs
in the ACS URL field. For example,https://OnPremOrchestrator.domain.com/identity/Saml2/Acs
. - In the same window, fill in the URL of the Orchestrator instance plus the suffix
identity
in the Entity ID field. For example,https://OnPremOrchestrator.domain.com/identity
.
- In the Service Provider window, fill in the URL of the Orchestrator instance plus the suffix
- Save the changes.
- Restart the IIS server.
OKTA
If you've previously configured OKTA to recognize a new Orchestrator instance, then you need to perform these steps:
- Login to OKTA, locate your existing application and modify the details on the SAML Settings window, in the General section, as follows:
- In the Single sign on URL field, fill in the URL of the Orchestrator instance plus the suffix
/identity/Saml2/Acs
. For example,https://OnPremOrchestrator.domain.com/identity/Saml2/Acs
. - Enable the Use this for Recipient URL and Destination URL check box, if it wasn't previously enabled. This will overwrite the Recipient URL and Destination URL fields with the value entered for Single Sign On URL, which in this example is
https://OnPremOrchestrator.domain.com/identity/Saml2/Acs
. - In the Audience URI field, fill in the URL of the Orchestrator instance plus the suffix
/identity
. For example,https://OnPremOrchestrator.domain.com/identity
.
- In the Single sign on URL field, fill in the URL of the Orchestrator instance plus the suffix
- Save the changes.
- Restart the IIS server.
Updated about a year ago