Identity Server acts as a federation gateway for a series of external identity providers (Google, Windows, Azure AD, SAML2) and it allows you to configure their settings in its External Identity Providers page. Orchestrator's UiPath.Orchestrator.dll.config file need not be changed to perform external identity provider configurations. Note that users are created within Identity Server's database.

If you are updating Orchestrator to v2020 and you've previously enabled any external identity provider authentication, there are a series of manual configurations to be performed at the external identity provider level. Previously created users are propagated to the Identity Server database.

🚧

Important!

Restart the IIS server after performing any configuration changes within Identity Server.

Managing External Identity Providers Settings

📘

Note:

The URLs are case-sensitive. For simplicity, we recommend the use of lower cases whenever possible.

Google OpenID Connect

This section empowers you to set the parameters that allow Orchestrator/Identity Server to use Google OpenID Connect authentication.
Here's an example of such a setup:

Before performing any settings in this page, make sure that you've configured Google to recognize your Orchestrator instance.
Follow the steps here to instruct Identity Server to use Google OpenID Connect authentication.

Windows

This section empowers you to set the parameters that allow Orchestrator/Identity Server to use Windows authentication.
Here's an example of such a setup:

Follow the instructions on this page to enable Windows authentication.

Azure AD

This section empowers you to set the parameters that allow Orchestrator/Identity Server to use Azure AD authentication.
Here's an example of such a setup:

Before performing any settings in this page, make sure that you've configured Azure AD to recognize your Orchestrator instance.
Follow the steps here to instruct Identity Server to use Azure AD authentication.

SAML

This section empowers you to set the parameters that allow Orchestrator/Identity Server to use single sign-on authentication using SAML 2.0.
You can find examples of such setups for the following external identity providers:

ADFS Authentication Using SAML 2.0

Before performing any settings in this page, make sure that you've configured ADFS to recognize your Orchestrator instance.
Follow the steps here to instruct Identity Server to use ADFS authentication.

Google Authentication Using SAML 2.0

Before performing any settings on this page, make sure that you've configured Google to recognize your Orchestrator instance.
Follow the steps here to instruct Identity Server to use Google SAML 2.0 authentication.

OKTA Authentication Using SAML 2.0

Before performing any settings on this page, make sure that you've configured OKTA to recognize your Orchestrator instance.
Follow the steps here to instruct Identity Server to use OKTA authentication.

Manual Configurations on Orchestrator Update

Upon updating to v2020.4, any external identity provider authentication enabled in Orchestrator is automatically migrated to Identity Server, along with all the existing users. However, some manual changes are required on your part, otherwise, the authentication will not work.

Here are the general actions you need to perform:

1. Go to the actual external provider's location.
2. Modify the Return URL by adding /identity after your Orchestrator URL.
3. Save the changes.

Read on for guidance on the actions needed for specific external identity providers.

🚧

Important!

Replace all occurrences of https://OnPremOrchestrator.domain.com with the URL of your Orchestrator instance.

Google OpenID Connect Authentication

If you've previously configured Google to recognize a new Orchestrator instance, then you need to perform these steps:

1. Access Google APIs and search for your previously created project.
2. In the Credentials page, select your previously created OAuth 2.0 Client.

3. In the Client ID for Web application page, edit the Authorized redirect URIs value by adding the suffix /identity after your Orchestrator URL. For example, https://OnPremOrchestrator.domain.com/identity/google-signin.
4. Click Save to save the changes.

Windows Authentication

If you've previously enabled Windows authentication, then no further manual actions are required on your part.

Azure AD Authentication

If you've previously configured Azure AD to recognize a new Orchestrator instance, then you need to perform these steps:

1. Access Microsoft Azure App Registrations page and select your previously registered app.
2. In the selected app's page, select Redirect URIs.
3. In the selected app's Authentication page, modify the Redirect URL by adding /identity/azure-sign-in-oidc to your Orchestrator URL.

3. Save the changes.
4. Restart the IIS server.

SAML2 Authentication

ADFS

If you've previously configured ADFS to recognize a new Orchestrator instance, then you need to perform these steps:

1. Open ADFS Management and modify your existing relying party trust for Orchestrator as follows:
   • In the Configure URL section, select the Enable support for the SAML 2.0 Web SSO Protocol and fill in the URL of the Orchestrator instance plus the suffix identity/Saml2/Acs in the Relying party SAML 2.0 SSO service URL field. For example, https://OnPremOrchestrator.domain.com/identity/Saml2/Acs.
   • In the Configure Identifiers section, fill in the URL of the Orchestrator instance plus the suffix identity in the Relying party trust identifier field. For example, https://OnPremOrchestrator.domain.com/identity.
2. Save the changes.
3. Once ADFS is configured, open PowerShell as an administrator and run the following commands:
   • Set-ADFSRelyingPartyTrust -TargetName "https://OnPremOrchestrator.domain.com/identity" -SamlResponseSignature MessageAndAssertion (Replace https://OnPremOrchestrator.domain.com with the URL of your Orchestrator instance)
   • Restart-Service ADFSSRV.
4. Restart the IIS server.

Google

If you've previously configured Google to recognize a new Orchestrator instance, then you need to perform these steps:

1. Open Google Admin console and modify your existing service's details as follows:
   • In the Service Provider window, fill in the URL of the Orchestrator instance plus the suffix identity/Saml2/Acs in the ACS URL field. For example, https://OnPremOrchestrator.domain.com/identity/Saml2/Acs.
   • In the same window, fill in the URL of the Orchestrator instance plus the suffix identity in the Entity ID field. For example, https://OnPremOrchestrator.domain.com/identity.
2. Save the changes.
3. Restart the IIS server.

OKTA

If you've previously configured OKTA to recognize a new Orchestrator instance, then you need to perform these steps:

1. Login to OKTA, locate your existing application and modify the details on the SAML Settings window, in the General section, as follows:
   • In the Single sign on URL field, fill in the URL of the Orchestrator instance plus the suffix /identity/Saml2/Acs. For example, https://OnPremOrchestrator.domain.com/identity/Saml2/Acs.
   • Enable the Use this for Recipient URL and Destination URL check box, if it wasn't previously enabled. This will overwrite the Recipient URL and Destination URL fields with the value entered for Single Sign On URL, which in this example is https://OnPremOrchestrator.domain.com/identity/Saml2/Acs.
   • In the Audience URI field, fill in the URL of the Orchestrator instance plus the suffix /identity. For example, https://OnPremOrchestrator.domain.com/identity.
2. Save the changes.
3. Restart the IIS server.