Subscribe

UiPath Orchestrator

The UiPath Orchestrator Guide

Host authentication settings

Installation key


The installation key is a token used to allow SSO connections to Orchestrator for integrated applications.

  1. Log in to the Management portal as a system administrator.
  2. On the Accounts & Groups page, select the Authentication Settings tab.
    The current installation key is displayed and you can click the Copy icon to copy it to your clipboard:
10201020
  1. (Optional) To generate a new installation key, click Generate new.
    A success message appears from the top right indicating that a new key was generated.

External providers


Orchestrator allows you to configure an external identity provider to control how your users sign in. The following table provides an overview of the different host-level external providers available.

Follow the instructions applicable for the external provider you want to use, as indicated below:

📘

New installation versus upgrade

The instructions indicated in the below table are for a new installation or if you are configuring one of the external providers for the first time.
If you upgraded Orchestrator and were already using one or more of the external providers listed below, the configuration is migrated, but you might need to perform some re-configuration tasks. If so, follow the instructions in Re-configuring authentication after upgrade instead.

External Provider Integration

Authentication

Directory Search

User Provisioning

Active Directory and Windows Authentication

Users can use SSO with Windows Authentication using the Kerberos protocol

Administrators can search for users from the Active Directory

Users must be assigned a role in the Orchestrator tenant. Active Directory users and groups can be assigned a role via directory search.

Azure Active Directory

Users can use SSO with Azure AD using the OpenID Connect protocol

Not supported

Users must be manually provisioned into the Orchestrator tenant with an email address matching their Azure AD account.

Google

Users can use SSO with Google using the OpenID Connect protocol

Not supported

Users must be manually provisioned into the Orchestrator tenant with an email address matching their Google account.

SAML 2.0

Users can use SSO with any Identity Provider that supports SAML

Not supported

Users must be manually provisioned into the Orchestrator tenant with a username matching their SAML account.

📘

Differences between integrating Azure AD at host-level and organization-level

The host-level Azure AD external identity provider only enables SSO functionality. The organization-level Azure AD integration enables SSO, directory search, and automatic user provisioning.

 

Allowing or restricting basic authentication

Basic authentication refers to signing in with the username and password of a local account.

If basic authentication is restricted, your users can only log in with their directory account, as defined in the external identity provider. Otherwise, users can log in with both their local accounts, if any, and their directory accounts.

Configuration levels and inheritance

This option can be configured:

  • at the host level, as described below.
    When set at the host level, the setting applies to all organizations and all their accounts, except if the basic authentication setting at the organization or account level was not explicitly set differently.
  • for system administrator accounts, as described below.
    Even when all organizations are restricted from using basic authentication, you can allow system administrators only to bypass this restriction.
  • at the organization level, as described in Configuring authentication and security.
    If set at the organization level, the organization-level setting overrides the host-level setting for only that organization. The setting for an organization applies to all accounts that belong to that organization, except accounts for which basic authentication is set differently at the account level.
  • at the account level, as described in Adding accounts.
    If set at the account level, the account-level setting overrides the host-level and organization-level basic authentication setting for only that account.

Setting basic authentication at the host level

This setting is only available if an external provider integration is enabled at the host level.

When set at the host level, the setting applies to all organizations and all their accounts. Set it according to the preference or recommendation across your company.
For exceptions, basic authentication can also be set at the organization or account level where you want this setting to apply differently.

To allow or restrict basic authentication for all organizations and all accounts:

  1. Log in to the host portal as a system administrator.
  2. Go to Users and select the Authentication Settings tab.
  3. Under External Providers, click the Disable basic authentication for the organizations toggle to restrict or allow sign in using basic authentication:
    • If off (left toggle position, gray toggle), basic authentication is allowed.
    • If on (right toggle position, blue toggle), basic authentication is restricted. While restricted, the Allow basic authentication for the host administrators toggle is available.
11851185
  1. If you restricted basic authentication, use the Allow basic authentication for the host administrators toggle to choose if you want to allow basic authentications for system administrators, as an exception:
    • If off (left toggle position, gray toggle), basic authentication is not allowed for system administrators either.
    • If on (right toggle position, blue toggle), even though basic authentication is not allowed, as an exception, it is allowed for system administrator accounts only.
  2. At the bottom-right of the External Providers section, click Save to apply your changes.

Recovering from lock out

When basic authentication is disabled, it is possible to get locked out if you lose access to your directory account.

To recover from this situation, go to https://<FQDN>/host/orchestrator_/account/hostlogin and log in using your basic authentication credentials.

Updated about a month ago


Host authentication settings


Suggested Edits are limited on API Reference Pages

You can only suggest edits to Markdown body content, but not to the API spec.