- Getting started
- Best practices
- Tenant
- About the Tenant Context
- Searching for Resources in a Tenant
- Managing Robots
- Connecting Robots to Orchestrator
- Storing Robot Credentials in CyberArk
- Storing Unattended Robot Passwords in Azure Key Vault (read only)
- Storing Unattended Robot Credentials in HashiCorp Vault (read only)
- Storing Unattended Robot Credentials in AWS Secrets Manager (read only)
- Deleting Disconnected and Unresponsive Unattended Sessions
- Robot Authentication
- Robot Authentication With Client Credentials
- SmartCard Authentication
- Configuring automation capabilities
- Audit
- Settings - Tenant Level
- Resource Catalog Service
- Folders Context
- Automations
- Processes
- Jobs
- Triggers
- Logs
- Monitoring
- Queues
- Assets
- Storage Buckets
- Test Suite - Orchestrator
- Other Configurations
- Increasing the Size Limit of Package Files
- Setting up Encryption Key Per Tenant
- GZIP Compression
- Integrations
- Host administration
- Organization administration
- Troubleshooting
Setting up Encryption Key Per Tenant
It is possible to use Microsoft Azure Key Vault to encrypt each tenant in your Orchestrator instance with its own unique key. Orchestrator uses the Key Vault to store and manage the keys in a safe manner, ensuring better segregation of your data between tenants.
Orchestrator installed in either Microsoft Azure or on premises can take advantage of this feature, yet the latter requires you to connect the Orchestrator instance to the internet and Azure Key Vault.
Orchestrator authentication is needed to use Azure Key Vault via App Registrations. App Registrations can grant a series of privileges to applications. In our case, Orchestrator is the application, and Azure Key Vault is the targeted privilege.
You first need to configure App Registrations access to Azure Key Vault. Orchestrator authentication with App Registrations is possible using the SSL private key available in Orchestrator Certificate Store and the SSL public key uploaded to App Registrations. After configuring the App Registrations and Key Vault, you need to make some changes to Orchestrator's config file. Once these criteria are met, Orchestrator can use Azure Key Vault to encrypt each tenant.
- Your own Microsoft Azure Key Vault
- A clean Orchestrator installation
-
A valid SSL certificate for your Orchestrator instance:
- Private Key Certificate - It needs to be uploaded in App Services > SSL Settings > Private Key Certificates and imported on the machine(s) Orchestrator is installed on. Keep in mind that the domain where the certificate was generated and installed has to match the domain of the user under which you run Orchestrator.
- Public Key Certificate - It needs to be uploaded in App registrations > Settings > Keys > Public Keys
-
(Optional) A self-signed certificate
Note: Encryption keys must not be edited on the Azure Key Vault side by users, such as enabling/disabling secrets or editing the activation date and expiration date. If a secret is disabled, data stored by Orchestrator for that tenant is no longer decrypted.
In Azure Portal's App Registrations pane, follow these steps:
- Create a new app registration.
- Copy the Application (Client) ID for later use.
- Go to Manage > Certificates & Secrets and upload the public SSL certificate key mentioned in the prerequisite.
- Copy the Thumbprint of this certificate for later use.
If you run Orchestrator under an Application Pool Identity, take the following steps:
- Import the SSL private key certificate into the Local Machine Personal Certificate Store.
- Give the Application Pool Identity access to the private key. The following steps explain how to do that.
- Open MMC.
- Go to File > Add/Remove Snap-in.
- Select Certificates and click Add > Computer Account > Local Computer.
- Click OK.
- Navigate to Certificates (Local Computer) > Personal > Certificates, click Finish, and then OK.
- In the MMC's main window, right-click the certificate you are interested in, then select All tasks > Manage private key.
- Click the Add button.
- In the Enter the object names to select field, enter IIS AppPool\<AppPoolName>. Example:
IIS AppPool\UiPath Orchestrator
. - Grant full control.
If you run Orchestrator under a custom account, take the following step:
- Import the SSL private key certificate mentioned in the prerequisites into the Personal Certificate Store of the user running the Orchestrator process.
If your Orchestrator is an Azure App Service installation, take the following step:
- Import the SSL private key certificate mentioned in the prerequisites into Orchestrator App Service > SSL Settings > Private Key Certificates .
UiPath.Orchestrator.dll.config
file:
- Open the
UiPath.Orchestrator.dll.config
file of your Orchestrator instance. - In the
AppSettings
section, do the following:- Set the
Database.EnableAutomaticMigrations
parameter totrue
. Otherwise, all subsequent changes to theUiPath.Orchestrator.dll.config
do not take effect. - Set
EncryptionKeyPerTenant.Enabled
totrue
. - Set
EncryptionKeyPerTenant.KeyProvider
toAzureKeyVault
. - For Orchestrator using Application Pool Identity, set
CertificatesStoreLocation
toLocalMachine
.
- Set the
- In the
secureAppSettings
section, do the following:- Remove or comment out the
EncryptionKey
key. - Copy the Input Application (Client) ID from the App Registrations page and provide it as a value for the
Azure.KeyVault.ClientId
parameter. Example:<add key="Azure.KeyVault.ClientId" value="ae11aa1a-1234-1234-a123-a12a12aaa1aa" />
. - Copy the Directory (tenant) ID of your organization from the App Registrations page and provide it as a value for the
Azure.KeyVault.DirectoryId
parameter. Example:<add key="Azure.KeyVault.DirectoryId" value="d8353d2a-b153-4d17-8827-902c51f72357" />
. - Copy the Thumbprint from the App Registrations page and provide it as a value for the
Azure.KeyVault.CertificateThumbprint
parameter. Example:<add key="Azure.KeyVault.CertificateThumbprint" value="1234123412341234123412341234124312341234" />
. - Copy the DNS Name from the Key Vaults Overview page and provide it as a value for the
Azure.KeyVault.VaultAddress
parameter. Example:<add key="Azure.KeyVault.VaultAddress" value="https://CustomVaultName.vault.azure.net/" />
.
- Remove or comment out the