About Identity Server

UiPath Identity Server is a service that offers centralized authentication and access control across UiPath products. Its purpose is to provide a coherent experience and parity of functionality for authentication and some aspects of authorization across all UiPath products and services. For Identity Server, these products and services are considered clients.

With the integration of Identity Server, its clients have a shared onboarding and user management experience. Behind the scenes, authentication is performed via Identity Server, which offers Single Sign-On experience and generates tokens to communicate with other products via APIs. Once a user signs in, Identity Server seamlessly performs the calls when accessing other products or services. The sign-out experience is similar - once a user signs out of one client, Identity Server performs the sign-out calls to all the other clients.

Identity Server also acts as a federation gateway, supporting external identity providers, thus shielding its client applications from details of how to connect to these external providers.

Identity Server offers Authentication as a Service, containing the centralized login logic and workflow for all its integrated applications. Built in .NET Core 3.1 on top of IdentityServer4 open-source library, and supporting OpenID Connect and OAuth 2.0 frameworks, IS makes it easier for any services to integrate with each other over one standard protocol family: OAuth.

Orchestrator Integration

Orchestrator is fully integrated with Identity Server and they are installed together. For Orchestrator, this integration means that:

• Login into Orchestrator is performed via Identity Server, and not through external identity providers.
• Orchestrator can consume user access tokens, service to service (s2s) access tokens, and robot access tokens generated by Identity Server.
• Email confirmation and password recovery moved to Identity Server.

• Orchestrator propagates and reads data to/from Identity Server. When creating a user or a tenant in Orchestrator, an entry for that user/tenant is automatically created in Identity Server. Robot information and some settings are also propagated to Identity Server. The user login attempts are sent from Identity Server to Orchestrator.

  Note: In order to login to Orchestrator using SSO, the user/tenant must be present in both Identity Server and Orchestrator databases.

Settings

Identity Server's settings can be configured as follows:

• A series of settings are configured during installation. Read about it here.
• In-depth configurations specific for your environment are performed within its appsettings.json file.

• External identity provider specific settings are configured within its Identity Management portal, within its External Identity Providers page.

  Important: Identity Server is mandatory in an Orchestrator installation or upgrade process. We don't support Orchestrator deployments without it.