- Getting started
- Best practices
- Organization Modeling in Orchestrator
- Managing Large Deployments
- Automation Best Practices
- Optimizing Unattended Infrastructure Using Machine Templates
- Organizing Resources With Tags
- Orchestrator Read-only Replica
- Exporting grids in the background
- About the Tenant Context
- Searching for Resources in a Tenant
- Managing Robots
- Connecting Robots to Orchestrator
- Storing Robot Credentials in CyberArk
- Storing Unattended Robot Passwords in Azure Key Vault (read-only)
- Storing Unattended Robot Credentials in HashiCorp Vault (read-only)
- Storing Unattended Robot Credentials in AWS Secrets Manager (read Only)
- Deleting Disconnected and Unresponsive Unattended Sessions
- Robot Authentication
- Robot Authentication With Client Credentials
- Resource Catalog Service
- Folders Context
- Bulk Uploading Queue Items Using a CSV File
- Managing Queues in Orchestrator
- Managing Queues in Studio
- Review Requests
- Storage Buckets
- Test Suite - Orchestrator
- Test Automation
- Testing Data Retention Policy
- Host administration
- Host Administration Portals
- Configuring System Email Notifications
- Managing System Administrators
- Configuring Host Security
- Host Audit Logs
- Customizing the Login Page
- Maintenance Mode
- Identity Server
- Organization administration
- Managing tags
- Audit Logs
- Overriding System Email Settings
- Other Configurations
Configuring the Active Directory Integration
After enabling this integration, local user accounts are linked to an Active Directory user and, in the process, their username attribute is updated to the format
user@domain. Thus the user can no longer use their original username to sign in and must instead use the new username in the format
user@domain, or the email address tied to the Active Directory account.
When you update your Orchestrator to 2020.4+, Identity Server migrates your previous settings. If you had previously enabled Windows authentication while having set up automatic login for Windows AD users, then after performing the upgrade, the users can't access the External Providers page if they previously logged into Identity Server. The users are logged in to the tenants directly after entering their Windows credentials.
Without being able to access the Login page, the host admin can't log in to the Host tenant, and they can't access Identity Management Portal.If this is your case, open a new browser in incognito mode and type
To integrate with Windows Active Directory (AD) and use Windows Authentication, LDAP port 389 must be accessible on one or more domain controllers in your domain.
Work with your IT administrators to ensure the Orchestrator server can access your Active Directory (AD).
If you plan on using LDAP over SSL (LDAPS), you must obtain and install certificates for configuring secure LDAP on each domain controller. For more information and instructions, see the article LDAP over SSL (LDAPS) Certificate .
When users log in to Orchestrator with their Active Directory credentials, Orchestrator uses the Kerberos protocol to authenticate users.
Requirements for multi-node clusters
- The nodes in the cluster must be deployed under a load balancer. Use the load balancer host name whenever the hostname is required in these instructions.
- The Orchestrator application pool must be configured to run under a custom identity. The custom identity should be a domain account.
This is only required if you are running a multi-node cluster, or a single-node cluster with a load balancer.
For single-node clusters with no load balancer, this is optional.
- Open IIS (Internet Information Services Manager).
- In IIS, in the Connections panel on the left, click Application Pools.
- Go to Identity > Advanced Settings > Process Model > Identity.
- In the Application Pool Identity dialog, select Custom account and specify a domain-qualified user account.
- Click OK to apply your changes.
- Close IIS.
If the Orchestrator application pool is configured to run under a custom identity, that account must have an SPN registered for the host name.
This step is required if you are running:
- a multi-node cluster because you must define a custom identity or
- a single-node cluster with a load balancer, which is treated the same as a multi-node cluster.
This step is not required if:
- you are running a single-node cluster with no load balancer and
- you chose to use a custom identity, but you used the cluster computer name as the custom identity
On a domain-joined machine that has write access in the target Orchestrator organization and tenant:
- Open the Command Prompt.
- Change the directory to
C:\Windows\System32, by using the
- Run the command
setspn.exe -a HTTP/<hostname> <domain account>, where:
- HTTP/<hostname> - The URL at which your Orchestrator instance can be accessed.
<domain account>- The name or domain\name of the custom identity as which the Orchestrator application pool is running.
- Open IIS (Internet Information Services Manager).
- In the Connections section, under the Sites node, select UiPath Orchestrator.
- In the main panel, double-click Authentication to view the details.
- Select Windows Authentication and then, in the Actions panel on the right, select Advanced Settings.Note: If not already enabled, enable Windows Authentication to continue with these instructions.
- Click the UiPath Orchestrator site on the left, and then double-click Configuration Editor in the main area.
- In the Configuration Editor, along the top, from the Section list, select system.webServer/security/authentication/windowsAuthentication.
- For useAppPoolCredentials, set the value to True:
- Log in to the Management portal as a system administrator.
- Go to Security Settings.
- In the External Providers section, click Configure under Active Directory:
The Configure Active Directory panel opens at the right of the screen.
- Select the Enabled checkbox.
- If you want to only allow users to log in using their Active Directory credentials, select the Force automatic login using this provider checkbox.
If selected, users can no longer log in using their Orchestrator username and password; they must use their Active Directory credentials, with a domain-qualified username.
- Optionally edit the value in the Display Name field to customize the label for the Windows authentication button that is displayed on the Login page.
- Restart the IIS site. This is required whenever you make changes to External Providers.
Now that the integration is configured, we recommend performing a test login using AD credentials and verifying that the Kerberos protocol is used for logging in.
- Log in to Orchestrator using your Active Directory credentials to create a login event.
Note the time when you logged in.
- Open Event Viewer in Windows.
- Go to Window Logs > Security.
- In the list of security events, look for the entry with the following specifics:
- Event ID: 4624
- Date and Time: Today's date and the time when you logged in with your Active Directory credentials.
- Double-click the row to open the event properties dialog.
- On the General tab, scroll down to the Detailed Authentication Information section and check the following:
If Kerberos authentication was used:
- the value of Authentication Package must be Negotiate
- the value of Package Name must be blank (
-) because this only applies for NTLM. If this value is NTLM V2, then the default authentication protocol was used and not Kerberos.