- Getting started
- Best practices
- Tenant
- About the Tenant Context
- Searching for Resources in a Tenant
- Managing Robots
- Connecting Robots to Orchestrator
- Storing Robot Credentials in CyberArk
- Storing Unattended Robot Passwords in Azure Key Vault (read-only)
- Storing Unattended Robot Credentials in HashiCorp Vault (read-only)
- Deleting Disconnected and Unresponsive Unattended Sessions
- Robot Authentication
- Robot Authentication With Client Credentials
- Audit
- Resource Catalog Service
- Folders Context
- Automations
- Processes
- Jobs
- Triggers
- Logs
- Monitoring
- Queues
- Assets
- Storage Buckets
- Test Suite - Orchestrator
- Host administration
- Identity Server
- Authentication
- Organization administration
- Other Configurations
- Integrations
- Classic Robots
- Troubleshooting
Host Authentication Settings
The installation key is a token used to allow SSO connections to Orchestrator for integrated applications.
Orchestrator allows you to configure an external identity provider to control how your users sign in. The following table provides an overview of the different host-level external providers available.
Follow the instructions applicable for the external provider you want to use, as indicated below:
The instructions indicated in the below table are for a new installation or if you are configuring one of the external providers for the first time.
If you upgraded Orchestrator and were already using one or more of the external providers listed below, the configuration is migrated, but you might need to perform some re-configuration tasks. If so, follow the instructions in Re-configuring authentication after upgrade instead.
External Provider Integration |
Authentication |
Directory Search |
User Provisioning |
---|---|---|---|
Users can use SSO with Windows Authentication using the Kerberos protocol |
Administrators can search for users from the Active Directory |
Users must be assigned a role in the Orchestrator tenant. Active Directory users and groups can be assigned a role via directory search. | |
Users can use SSO with Azure AD using the OpenID Connect protocol |
Not supported |
Users must be manually provisioned into the Orchestrator tenant with an email address matching their Azure AD account. | |
Users can use SSO with Google using the OpenID Connect protocol |
Not supported |
Users must be manually provisioned into the Orchestrator tenant with an email address matching their Google account. | |
Users can use SSO with any Identity Provider that supports SAML |
Not supported |
Users must be manually provisioned into the Orchestrator tenant with a username matching their SAML account. |
To configure security options for your Orchestrator installation, in the Orchestrator host portal, go to Security Settings and, under Basic sign-in, click Edit password policy.
The settings you specify here, at the host level, are inherited by all organizations in your installation as default, but organization administrators can overwrite these settings as needed at the level of the individual organization.
Field |
Description |
---|---|
Special characters |
Select to force users to include at least one special character in their password. By default, this checkbox is not selected. |
Lowercase characters |
Select to force users to include at least one lowercase character in their password. By default, this checkbox is selected. |
Uppercase characters |
Select to force users to include at least one uppercase character in their password. By default, this checkbox is not selected. |
Digits |
Select to force users to include at least one digit in their password. By default, this checkbox is selected. |
Minimum password length |
Specify the minimum number of characters a password should contain. By default, it is 8. The length must be set between 1 and 256 characters. |
Days before password expiration |
Specify the number of days for which the password is available. After this period, the password expires and needs to be changed. The minimum accepted value is 0 (the password never expires), and the maximum is 1000 days. |
Number of times a password can be reused |
The minimum accepted value is 0 (never allow reusing a password), while the maximum is 10. |
Change password on the first login |
If set to Required, users that log in for the first time must change their password before being allowed to access Orchestrator. If set to Not required, users can log in and continue to use the admin-defined password until it expires. |
Field |
Description |
---|---|
Enabled or Disabled toggle |
If enabled, locks the account for a specific amount of seconds after a specific amount of failed login attempts. This also applies to the password change feature. |
Account lockout duration |
The number of seconds a user needs to wait before being allowed to log in again after exceeding the Consecutive login attempts before lockout. The default value is 5 minutes. The minimum accepted value is 0 (no lockout duration), and the maximum is 2592000 (1 month). |
Consecutive login attempts before lockout |
The number of failed login attempts allowed before the account is locked. The default value is 10 attempts. You can set a value between 2 and 10. |