Single sign-on

When using Active Directory single sign-on in Blue Prism, it is possible to configure the system to support users from across multiple forests within a common Active Directory network infrastructure with options for role management either in Blue Prism or Active Directory, or both.

This applies to the following scenarios:

• Active Directory users logging into the interactive client via Authentication Server.
• Active Directory users logging into the interactive client using built-in authentication.
• Authentication of AutomateC commands, runtime resources, and process alerts via the /sso command line parameter.
• Authentication of telnet commands and web service requests.

The following prerequisites must be met before configuring Active Directory authentication in Blue Prism:

• The local machine on which the Blue Prism interactive client is installed and on which the Blue Prism administrator is logged on must be a member of an Active Directory domain.
• All devices must be connected via a Blue Prism application server with a secure connection mode.
• If using multiple Active Directory domains, the appropriate credentials for each relevant Active Directory domain must be configured in Blue Prism.

The following configuration must be carried out to enable Active Directory user authentication in Blue Prism:

• The Blue Prism administrator must enable Active Directory authentication and select at least one of the role management options for Active Directory users on the System > Security - Sign-on Settings screen in the Blue Prism interactive client:

  • Manage role membership in Blue Prism – Active Directory users are directly assigned to Blue Prism roles.

  • Manage role membership in Active Directory – Active Directory security groups are mapped to Blue Prism roles. Users are assigned the relevant Blue Prism roles based on their Active Directory security group membership when they log in.

• Depending on the role management option(s) selected on the Security - Sign-on Settings screen, Active Directory users must be created in Blue Prism by:

  • Manually creating users and directly assigning them roles and permissions via the Create user wizard, and/or
  • Assigning Active Directory security groups to Blue Prism roles via the Role Membership dialog. Blue Prism user accounts for users belonging to Active Directory security groups are created either when they log into Blue Prism for the first time, or when administrators manually synchronize users with Active Directory on the Security - Users screen.

  Active Directory authentication in Blue Prism does not support built-in security groups or those with derived membership such as domain users or authenticated users.

Active Directory can be integrated with both Blue Prism and Authentication Server. Authentication Server users configured to use Active Directory authentication in Hub can also be added to Blue Prism based on their Active Directory security group membership. For more details, see Add Active Directory users to Blue Prism based on their security group membership and the Hub administrator guide.

Troubleshooting

If you experience any issues, see Single Sign-on troubleshooting.