通知を受け取る

UiPath Automation Suite

UiPath Automation Suite ガイド

Kerberos 認証を設定する

前提条件


Kerberos 認証を適切に設定するには、次の前提条件を満たす必要があります。

 

Ensuring the Automation Suite cluster can access your AD

Before you can configure Kerberos authentication, work with your IT administrators to ensure the Automation Suite cluster can access your AD.
The following requirements must be met:

  • Automation Suite cluster must be on the same network as the AD domain;
  • DNS must be set up correctly on the network so that the Automation Suite cluster can resolve the AD domain names.

📘

注:

It is critical that the Automation Suite cluster can resolve the AD domain names. You can verify this by running nslookup <AD domain name> on the host machine.

 

Configuring the AD service account for Kerberos authentication

Reach out to your AD administrator for an AD user account, and retrieve the <KERB_DEFAULT_USERNAME> and <KERB_DEFAULT_KEYTAB> for that account as follows:

  1. In your AD Server, create a new user account. If you already have one, skip to step 2.
    1.1. In the Active Directory Users and Computers console, right-click the Users folder, click New, and then select User.
    1.2. Finish creating the user account.
  2. Right-click the user account and select Properties.
  3. Go to the Account tab, then under Account options, select This account supports Kerberos AES 256 bit encryption.
  4. Important: The keytab generated in the next steps will become invalid if the AD user's password is expired or updated. Consider checking Password never expires under Account options for this AD user account. Alternatively, you can update the password when it is about to expire and generate a new keytab.
  5. To generate a keytab file for the SPN, open PowerShell with admin access and execute the following command:
ktpass -princ HTTP/<Service Fabric FQDN>@<AD FQDN in cap> -pass <AD user's password> -mapuser <AD NetBIOS name in cap>\<AD user name> -pType KRB5_NT_PRINCIPAL -out <output file path> -crypto AES256-SHA1

一部のフィールドは大文字で指定する必要があります。例:

ktpass -princ HTTP/[email protected] -pass pwd123 -mapuser TESTDOMAIN\aduser -pType KRB5_NT_PRINCIPAL -out c:\krb5.keytab -crypto AES256-SHA1

📘

注:

After the keytab generation, the User logon name changes to HTTP/<Service Fabric FQDN>. Let's call this value <KERB_DEFAULT_USERNAME> です。

  1. Encode the generated keytab file in Base64, open PowerShell, and execute the following command:
[Convert]::ToBase64String([System.IO.File]::ReadAllBytes("<path to the generated keytab file>"))
  1. Save the encoded keytab file. You will use it when configuring the UiPath cluster for Kerberos. Let's call the value from step 6 <KERB_DEFAULT_KEYTAB> です。

 

Optional: SQL integrated authentication prerequisites

To configure the UiPath cluster to connect to SQL using Windows integrated authentication/Kerberos, you need to perform a few additional steps:

  • the SQL server must join the AD domain;
  • the Automation Suite cluster must be on the same network as the SQL Server;
  • the Automation Suite cluster can resolve the AD and SQL servers` domain names;
  • the AD user must have access to SQL server and DB permissions.
詳しい手順を表示するにはこちらをクリックしてください。

To create a new login in SQL Server Management Studio, take the following steps:
a. [オブジェクト エクスプローラー] パネルで [セキュリティ] > [ログイン] の順に選択します。
b. [ログイン] フォルダーを右クリックして [新しいログイン] を選択します。[ログイン - 新規作成] ウィンドウが表示されます。
c. [Windows 認証] オプションを選択します。ウィンドウが適切に更新されます。

704704

d. [ログイン名] フィールドに、サービス アカウントとして使用するユーザー ドメインを入力します。
e. [既定の言語] リストから [英語] を選択します。

❗️

重要

[既定の言語][英語] に設定されていることを確認してください。そうでない場合、Web サイトは開始できず、Orchestrator がインストールされているコンピューター上のイベント ビューアーに、「varchar データ型から datetime データ型へ変換した結果、値が範囲外になりました」というエラー メッセージが表示されます。

f. [OK] をクリックします。設定が保存されます。
サービス アカウントが既に作成され、SQL Server の [セキュリティ] > [ログイン] セクションに追加されている場合、SQL アカウントの [既定の言語] が [英語] に設定されていることを確認してください。英語に設定されていない場合は、適切に変更します。

You need to provide the user connecting to the SQL database with the db_owner user mapping role, as in the following screenshot.

704704

If security restrictions do not allow you to use the db_owner user mapping role with the UiPath login, grant the following permissions:

  • db_datareader
  • db_datawriter
  • db_ddladmin
  • EXECUTE permission on dbo schema
705705

★削除★ EXECUTE permission has to be granted by using the GRANT EXECUTE SQL command, as follows:

USE UiPath
GO
GRANT EXECUTE ON SCHEMA::dbo TO [domain\user]
GO

If you want UiPath applications to use unique accounts to connect to SQL using Integrated Security=True, you need to create a unique keytab for each UiPath application, as follows. This will be referred to as <KERB_APP_KEYTAB> for that application.

# Generate keytab file and output it in the desired path 
ktpass /princ <AD username>@<AD domain in cap> /pass <AD user password> /ptype KRB5_NT_PRINCIPAL /crypto AES256-SHA1 /out <path to keytab file> -setpass 

# Converts AD user's keytab file to base 64 
[Convert]::ToBase64String([System.IO.File]::ReadAllBytes("<path to the generated keytab file>"))

The value <AD username> will be the <KERB_APP_USERNAME> corresponding to the <KERB_APP_KEYTAB> です。

 

Configuring Automation Suite as a Kerberos client


This section explains how you can configure Automation Suite as a Kerberos client for LDAP or SQL access.

With <KERB_DEFAULT_KEYTAB>, configure Automation Suite as a Kerberos client in one of the following ways:

📘

注:

If you want to set up different services to run under their own AD account, and access SQL as that AD account, you can specify ad_username with that <KERB_APP_USERNAME>, and user_keytab as <KERB_APP_KEYTAB> under the configuration section of the service.

 

対話型インストーラーを介して Kerberos 認証を構成する

  1. When running the Automation Suite installer, specify that you want to enable Kerberos Auth in the Deployment configuration:
===============================================================================
                            Deployment configuration
===============================================================================

Are you performing an evaluation/development/test/demo or a production deployment?
[1] Production deployment (multi-node)
[2] Evaluation/development/test/demo deployment (single-node)
Enter your choice [2]: 2

Will your deployment have access to Internet (online) or is it physically isolated from unsecured networks (air-gapped)?
[1] Online
[2] Air-gapped
Enter your choice [1]: 1
Enter the Automation Suite FQDN []: sfdev1868610-d053997f-lb.eastus.cloudapp.azure.com
sfdev1868610-d053997f-lb.eastus.cloudapp.azure.comsfdev1868610-d053997f-lb.eastus.cloudapp.azure.com

Would you like to enable Kerberos Auth? This will be used to connect to SQL Databases and Active Directory Lightweight Directory Adaptor if configured.
[1] Yes
[2] No

Enter your choice [2]: 1
  1. Provide the input parameters for Kerberos Auth:

📘

注:

これは、すべてのサービスに対する既定の Kerberos 認証設定です。サービスごとに異なる AD ユーザーを設定する場合は、インストールの後続の手順において、サービス固有の JSON オブジェクト内で値を指定できます。

Specify the Active Directory domain for Kerberos Auth []: 
Specify the Ticket Granting Ticket lifetime (TGT) in hours between 8 and 168 for Kerberos Auth [8]:
Specify the default Active Directory username for Kerberos Auth []: 
Specify the default Active Directory user's keytab for Kerberos Auth []: 
Specify the SQL server FQDN []: 
Specify the SQL server connection PORT [1433]:

📘

注:

The AD domain controller has the Maximum lifetime for user ticket Kerberos setting inside the Default Domain Policy. Make sure the ticket lifetime configured here is not longer than the server-side setting.


You must generate the keytab file (<KERB_DEFAULT_KEYTAB>) as described in the Prerequisites section and provide the base64 encoded value to the installer. Then, you must provide <KERB_DEFAULT_USERNAME> as a value for Active Directory username to the installer.

  1. 次の例に示すとおり、インストール手順の残りの部分を実行します。
Would you like the databases to be automatically provisioned for all the products you've selected?
[1] Yes
[2] No

Enter your choice [1]: 1

The following databases will be provisioned automatically:
- Shared suite capabilities: AutomationSuite_Platform
- Orchestrator: AutomationSuite_Orchestrator
- Test Manager: AutomationSuite_Test_Manager
- Insights: AutomationSuite_Insights
- Automation Hub: AutomationSuite_Automation_Hub
- Automation Ops: AutomationSuite_Automation_Ops
- AI Center: AutomationSuite_AICenter
- Document understanding: AutomationSuite_DU_Datamanager


===============================================================================
                            Current config values
===============================================================================
Multi node: false
Airgapped: false
Automation Suite FQDN: sfdev1868610-d053997f-lb.eastus.cloudapp.azure.com
Sql server FQDN: sfdev1868610-d053997f-sql.database.windows.net
Sql port: 1433
Sql username:
Sql password:
Create sql databases: true
Kerberos Auth enabled: true
Kerberos Auth Active Directory domain: abcd.com
Kerberos Auth TGT lifetime in hours: 8
Kerberos Auth default Active Directory username: ad_user
Kerberos Auth default user's keytab: XXXXXXXXX


✅ The cluster configuration file was generated at /tmp/UiPathAutomationSuite/cluster_config.json:

[1] Continue installing with the default config
[2] Edit the config
[3] Go to the main menu

For advanced settings, quit now and manually edit the config file.
Once the configuration file is updated, run the deployment wizard again and follow the instructions.
Would you like the databases to be automatically provisioned for all the products you've selected?
[1] Yes
[2] No

Enter your choice [1]: 1

The following databases will be provisioned automatically:
- Shared suite capabilities: AutomationSuite_Platform
- Orchestrator: AutomationSuite_Orchestrator
- Test Manager: AutomationSuite_Test_Manager
- Insights: AutomationSuite_Insights
- Automation Hub: AutomationSuite_Automation_Hub
- Automation Ops: AutomationSuite_Automation_Ops
- AI Center: AutomationSuite_AICenter
- Document understanding: AutomationSuite_DU_Datamanager


===============================================================================
                            Current config values
===============================================================================
Multi node: false
Airgapped: false
Automation Suite FQDN: sfdev1868610-d053997f-lb.eastus.cloudapp.azure.com
Sql server FQDN: sfdev1868610-d053997f-sql.database.windows.net
Sql port: 1433
Sql username:
Sql password:
Create sql databases: true
Kerberos Auth enabled: true
Kerberos Auth Active Directory domain: abcd.com
Kerberos Auth TGT lifetime in hours: 8
Kerberos Auth default Active Directory username: ad_user
Kerberos Auth default user's keytab: XXXXXXXXX


✅ The cluster configuration file was generated at /tmp/UiPathAutomationSuite/cluster_config.json:

[1] Continue installing with the default config
[2] Edit the config
[3] Go to the main menu

For advanced settings, quit now and manually edit the config file.
Once the configuration file is updated, run the deployment wizard again and follow the instructions.
  1. Optional: you can edit the configuration, as shown below:
===============================================================================
                    Choose what setting you want to edit
===============================================================================
[1] Multi node: false
[2] Airgapped: false
[3] Automation Suite FQDN: sfdev1868610-d053997f-lb.eastus.cloudapp.azure.com
[4] Sql server FQDN: sfdev1868610-d053997f-sql.database.windows.net
[5] Sql port: 1433
[6] Sql username:
[7] Sql password:
[8] Create sql databases: true
[9] Kerberos Auth enabled: true
[10] Kerberos Auth Active Directory domain: abcd.com
[11] Kerberos Auth TGT lifetime in hours
[12] Kerberos Auth default Active Directory username: ad_user
[13] Kerberos Auth default user's keytab: XXXXXXXXX===============================================================================
                    Choose what setting you want to edit
===============================================================================
[1] Multi node: false
[2] Airgapped: false
[3] Automation Suite FQDN: sfdev1868610-d053997f-lb.eastus.cloudapp.azure.com
[4] Sql server FQDN: sfdev1868610-d053997f-sql.database.windows.net
[5] Sql port: 1433
[6] Sql username:
[7] Sql password:
[8] Create sql databases: true
[9] Kerberos Auth enabled: true
[10] Kerberos Auth Active Directory domain: abcd.com
[11] Kerberos Auth TGT lifetime in hours
[12] Kerberos Auth default Active Directory username: ad_user
[13] Kerberos Auth default user's keytab: XXXXXXXXX

 

cluster_config.json を介して Kerberos 認証を構成する cluster_config.json

  1. In the cluster_config.json file, set the kerberos_auth_config.enabled parameter to true です。

  2. If you want to use Kerberos for SQL access, configure the sql_connection_string_template sql_connection_string_template_jdbc, and sql_connection_string_template_odbc with the Integrated Security flag.

  3. If you want to set up a different AD user per service, take the following steps:
    i. Specify the ad_username and user_keytab in the JSON object of the service group.
    ii. Update the SQL connection string for the service to enable integrated security.
    The JSON object should be as follows:

"<serviceGroupName>": {
    "kerberos_auth_config": {
      "ad_username": "PLACEHOLDER - INSERT KERB_APP_USERNAME for this service group",
      "user_keytab": "PLACEHOLDER - INSERT KERB_APP_KEYTAB for this service group"
    }
}

📘

For the list of service group names, see Service groups and services.

  1. After updating the cluster_config.json, run the installer script to update the configuration. For details, see Managing products.

Sample of updating Orchestrator and the platform to use Kerberos authentication

"kerberos_auth_config": {
    "enabled" : true, 
    "ticket_lifetime_in_hour" : 8, 
    "ad_domain": "PLACEHOLDER - INSERT ACTIVE DIRECTORY DOMAIN ",
    "default_ad_username": "PLACEHOLDER - INSERT KERB_DEFAULT_USERNAME",
    "default_user_keytab": "PLACEHOLDER - INSERT KERB_DEFAULT_KEYTAB"
  },
"sql_connection_string_template": "PLACEHOLDER",
"sql_connection_string_template_jdbc": "PLACEHOLDER",
"sql_connection_string_template_odbc": "PLACEHOLDER",
"orchestrator": {
    "sql_connection_str": "Server=tcp:sfdev1804627-c83f074b-sql.database.windows.net,1433;Initial Catalog=AutomationSuite_Orchestrator;Persist Security Info=False;Integrated Security=true;MultipleActiveResultSets=False;Encrypt=True;TrustServerCertificate=False;Connection Timeout=30;Max Pool Size=100;",
    "kerberos_auth_config": {
      "ad_username": "PLACEHOLDER - INSERT KERB_APP_USERNAME for Orchestrator",
      "user_keytab": "PLACEHOLDER - INSERT KERB_APP_KEYTAB for Orchestrator"
    }
    "testautomation": {
      "enabled": true
    },
    "updateserver": {
      "enabled": true
    }
},
"platform": {
    "sql_connection_str": "Server=tcp:sfdev1804627-c83f074b-sql.database.windows.net,1433;Initial Catalog=AutomationSuite_Platform;Persist Security Info=False;Integrated Security=true;MultipleActiveResultSets=False;Encrypt=True;TrustServerCertificate=False;Connection Timeout=30;Max Pool Size=100;",
    "kerberos_auth_config": {
      "ad_username": "PLACEHOLDER - INSERT KERB_APP_USERNAME for platform",
      "user_keytab": "PLACEHOLDER - INSERT KERB_APP_KEYTAB for platform"
    }
}

Service groups and services

The following table lists the available service groups and the services that they include, The names are slightly different in the cluster_config.json file, or in the ArgoCD UI.

Service group name for cluster_config.json

Service group name for ArgoCD

Included services

orchestrator

orchestrator

Orchestrator, Webhooks

platform

platform

Identity, License Accountant (LA), Audit, Location, License Resource Manager (LRM), Organization Management Service (OMS)

discovery_group

discoverygroup

Automation Hub, Task Mining

test_manager

testmanager

Test Manager

automation_ops

automationops

Automation Ops

aicenter

aicenter

AI Center

documentunderstanding

documentunderstanding

Document Understanding

insights

insights

Insights

 

ArgoCD UI を介して Kerberos 認証を更新する

  1. ArgoCD UI に移動して uipath アプリケーションを見つけ、左上隅の [APP DETAILS] ボタンをクリックしてから、[PARAMETERS] タブに移動します。

  2. [EDIT] をクリックし、次のパラメーターを指定した値に変更したうえで、新しい構成を保存します。

Parameter

Value

global.kerberosAuthConfig.adDomain

AD domain

global.kerberosAuthConfig.adUserName

KERB_DEFAULT_USERNAME

global.kerberosAuthConfig.enabled

true

global.kerberosAuthConfig.userKeytab

KERB_DEFAULT_KEYTAB

global.kerberosAuthConfig.ticketLifetimeInHours

8 (default)

📘

注:

The AD domain controller has Maximum lifetime for user ticket Kerberos setting inside Default Domain Policy. Make sure the ticket life time configured here is not longer than the server side setting.

  1. If you want to use SQL with integrated authentication, and you need to use a unique user account per application, you must configure the following parameters for each application.

    Update the adUserName and userKeytab of the service group, in the following format:
    global.userInputs.<serviceGroupName>.kerberosAuthConfig.adUserName
    global.userInputs.<serviceGroupName>.kerberosAuthConfig.userkeytab
    :

Parameter example

Value

global.platform.kerberosAuthConfig.adUserName

KERB_APP_USERNAME for platform

global.platform.kerberosAuthConfig.userKeytab

KERB_APP_KEYTAB for platform

global.orchestrator.kerberosAuthConfig.adUserName

KERB_APP_USERNAME for Orchestrator

global.orchestrator.kerberosAuthConfig.userKeytab

KERB_APP_KEYTAB for Orchestrator

  1. Sync the uipath application, and wait for the sync to finish with a healthy state response.

  2. If you want to use Kerberos for SQL access, you can now update the SQL connection string for each service with the Integrated Security flag to start using integrated authentication.

 

Updating Kerberos authentication via CLI tool

To update Kerberos authentication via the CLI tool, see Updating Kerberos authentication.

 

Active Directory との連携を構成する


For Kerberos authentication to be used when logging in to Automation Suite, you must further configure Automation Suite host settings.
For instructions, see Configuring the Active Directory integration.

 

Disabling Kerberos authentication


Removing Kerberos authentication completely

To remove Kerberos authentication completely, take the following steps:

  1. If you used Kerberos to configure AD integration, reconfigure AD with the username and password option by following the instructions in Configuring the Active Directory integration.
  2. If you used SQL integrated authentication, configure the SQL connection strings to use User Id and Password.
  3. Disable Kerberos authentication as follows:
    a. Go to the ArgoCD UI, find the uipath application, click the APP DETAILS button in the top-left corner, and then navigate to the PARAMETERS tab.
    b. Click EDIT, and set updateglobal.kerberosAuthConfig.enabled to false です。

Removing SQL integrated authentication

To remove SQL integrated authentication, take the following steps:

  1. Configure the SQL connection strings to use User Id and Password.
  2. If want to disable SQL integrated authentication for all the services, set global.kerberosAuthConfig.enabled
    終了日: false in ArgoCD after changing all of the connection strings.

 

Kerberos troubleshooting


If you encounter any issues while configuring Kerberos, see Troubleshooting.

28 日前に更新


Kerberos 認証を設定する


改善の提案は、API リファレンスのページでは制限されています

改善を提案できるのは Markdown の本文コンテンツのみであり、API 仕様に行うことはできません。