Blue Prism application server

Run the appropriate installer depending on whether you want to use the 32-bit or 64-bit installer.

• 32-bit Installer: BluePrismx.x.nn_x86.msi
• 64-bit Installer: BluePrismx.x.nn_x64.msi

Installers are available from the Blue Prism Portal.

Click Get started to follow the steps in the installation wizard and complete the installation. If required, you can change the language in the wizard by clicking Choose language at the top of the first screen.

Advanced install options

The following additional components are available during a Blue Prism installation if the Advanced install option is enabled on the Install location screen. Components selected by default that are not required must be deselected before proceeding with the installation.

When Blue Prism is launched for the first time it is necessary to define a connection to the SQL Server instance where the database is, or will be, hosted.

1. On the Blue Prism login screen, click Configure connection.

   

2. In the Connection Configuration dialog, specify the connection details as outlined in the image below:

   

   *If the Connection type selected includes Windows Authentication, the context of the user currently logged into the device will be used to authenticate against the SQL Server. Where possible Windows Authentication (rather than SQL Authentication) should be used.

   • SQL Server (SQL Authentication) – Connection Name (must be unique), Database Server, Database Name, User ID
   • SQL Server (Windows Authentication) – Connection Name (must be unique), Database Server, Database Name
   • Availability Group (SQL Authentication) – Connection Name (must be unique), Database Server, Database Name, User ID
   • Availability Group (Windows Authentication) – Connection Name (must be unique), Database Server, Database Name
   • SQL Server (Custom Connection String) – Connection String (the complete SQL connection string must be used)

   ** Can be left blank. Populate if there is a requirement to add custom SQL Connection Parameters such as: encrypt=true; trustservercertificate=true.

   See SQL Server Connection Properties information provided by Microsoft for a list of available values.

   If connecting to Microsoft SQL Azure, the database must be pre-existing, and the connection details provided within the Azure database configuration area should be used. Example settings (ADO.NET) are provided below:

   Connection Type	SQL Server (SQL Authentication)
   Database Server:	e12n3456.database.windows.net,1433
   Database Name:	BluePrism
   User ID:	authUser@e12n3456
   Password:	*********

3. Click Test Connection to establish if a connection can be established with the SQL Server.

   As the database does not yet exist, one of the following messages will display:

   Expected responses

   Database 'Blue Prism' does not exist.	This does not appear to be a valid Blue Prism database.
   Indicates that a successful connection was established with the server, but that the database does not yet exist.	Indicates that a successful connection was established with the server, but that it cannot be verified as a Blue Prism database. This would typically be the case where the database has been manually created but has not had the Blue Prism schema applied.
   Click OK to clear the message and then click Create Database.
   Proceed to the next step for further instructions.

   Alternative responses

   Database Valid	Unable to determine whether database exists – A network-related or instance-specific error occurred whilst establishing a connection to SQL Server. The server was not found or was not accessible. Verify that the instance name is correct and that SQL Server is configured to allow remote connections. (provider: Named Pipes Provider, error: 40 – Could not open a connection to SQL Server)
   Indicates that a successful connection was established with the server and the database. Actions to Create the database can be bypassed.	Indicates that an error occurred establishing a connection with the SQL Server. Check that the details for the SQL Server instance are correct, and refer to Troubleshooting an installation.

There are two stages involved in the creation and preparation of a database for use with Blue Prism.

• Create a SQL Server database – This can either be achieved manually or by using the Create Database action.
• Apply Blue Prism schema – The database schema is applied to the database.
• The Create Database action will automatically apply the schema to a database that it creates; or to a specifiable pre-existing blank database.
• Alternatively, the schema can be applied by manually using the CreateScript.sql against a pre-existing database. The CreateScript.sql can be obtained via request from Blue Prism Customer Support or generated using the Blue Prism client – Click Generate Script at the bottom of the Create a new database or Upgrade the database screens.

All of the above is completed in a single step when using the Create Database functionality.

1. To create a database, click Create Database in the Connection Configuration dialog.

   

2. In the Create a new database dialog, enable the Drop any existing database with the specified name option if you want to purge and recreate a database that already exists.

3. Click OK to complete the database configuration.

   

Support for contained databases

Blue Prism supports the use of contained databases, hosted on Microsoft SQL Server. To use a contained database, it is necessary to manually create the database and apply the Blue Prism CreateScript.sql.

For more information, see Contained databases.

A number of optional settings are commonly applied. These can be found under System > System - Settings.

For more information, see System settings.

It is recommended that the installation is manually verified by carrying out some simple tasks within the system and confirming that they execute successfully.

For step-by-step instructions, see Verify an Installation.

1. Navigate to the Blue Prism installation directory, typically C:\Program Files\Blue Prism Limited\Blue Prism Automate and launch BPServer.exe.
   

2. Click New configuration to create a server configuration.

   The recommended approach for a brand new installation is to edit the default configuration. A new configuration is typically only required for additional server configuration on the same server, or if you decide to create a new configuration from scratch.

   

3. Add the required details in the Server Configuration Details dialog. Ensure that the connection mode, bindings and listening port are correct.
   • Name – Name for the server profile. The first one must be called Default.
   • Database Connection – Connection used to connect to the database.
   • Connection Mode – Connection mode to be used by connecting devices.
   • Binding – Optional binding for the endpoint for scenarios where requests must be received on a specific URL or address.
   • Port – Server listening port.

   • Disable Scheduler – Indicates whether this server should have the scheduler enabled.

     

4. If a connection mode has been selected which requires a certificate to be configured, a message will be displayed and the Certificates tab will become available. This allows a certificate that has been configured as a Computer certificate on the local device to be associated with the server service.

   

   If the certificates tab is not displayed, progress to the next step.

   1. Select to add a new certificate binding and enter the binding information and which store on the local device the certificate has been installed in.
      
   2. Click OK to launch the Windows certificate selection utility and pick the appropriate certificate.
      
   3. It is necessary to select a certificate that matches the binding on the details tab.

5. Select the Key Store tab and click New.

   An entry must be made for each Encryption Scheme defined via the Blue Prism client that is configured to use a key stored on the application server.

   The name of the Encryption Schemes must be an exact match of those configured in the client.

   When using a default configuration only one Encryption Scheme will be required named Default Encryption Scheme.

6. Click Generate Key and then click OK. 

   If this is an additional application server instance for an existing Blue Prism deployment, the algorithm and key must match that on the pre-existing server.

   Commonly security conscious users will also select to store keys separately in individual files so that the target locations can controlled.

   A copy of each key must be backed up in a secure location – it will be needed to retrieve encrypted data if the server fails.

7. Review the settings on the Server Services tab to ensure that no problems have been identified so far.

   

8. Click Save.

For more information on additional server settings you might need to configure post installation, see Blue Prism Server.

The encryption settings of the BP server can be configured to protect the server's encryption keys when they are stored in the application server.

Certificate encryption of server configuration files is recommended for deployments that need to be the most secure and it requires a locally-deployed certificate with an associated private key to be available. See Using certificate encryption for details.

1. Navigate to the Blue Prism installation directory, by default C:\Program Files\Blue Prism Limited\Blue Prism Automate and launch BPServer.exe.
   

2. Click Encryption settings to configure the encryption settings that will be applied to the information stored in the local configuration files used by the Blue Prism application server.

   

3. In the Select Encryption Method dialog, select to use either the default Blue Prism encryption or your own certificate. We recommend using your own certificate.

   We recommend using your own certificate. See Using certificate encryption.

   When selecting to use your own certificate, enter the thumbprint from your certificate, which is the automatically generated ID for the certificate.

   

4. Click OK.

Using certificate encryption

If you have chosen to use certificate encryption for the application server configuration data, the following elements must be considered to ensure access for all relevant components and for continued successful encryption.

Certificate storage

The certificate used to encrypt server configuration data must use RSA encryption and contain a public/private key pair. The certificate must also be stored on the local machine in the following location:
[Certificates - Local Computer\Personal\Certificates].

Certificate access

To ensure that the user configuring the Blue Prism server and the user account on which the server service runs have read access to the private keys on the certificate:

1. In the Manage Computer Certificates window select the certificate to which you need to give read access.
2. From the shortcut menu select All Tasks > Manage Private Keys.

3. In the Permissions dialog ensure the user account on which the server service is running has read access to the certificate. Add any users or groups that also need read access to the certificate.

   

If you have chosen to store encryption scheme keys in separate files, the certificate encryption will be applied to the separate files. If the location of the separate files is shared with other application servers, they will all need the same certificate to be stored locally and have a minimum of read access to the private key.

Encrypting server configuration data

When you use certificate encryption, all encrypted data from the server configuration is decrypted and held in protected memory. When a new encryption method or certificate thumbprint is selected, the file is saved, encrypting the secret data as they are read from protected memory and written to the file.

When you select certificate encryption, the following application server configuration data is encrypted:

• The encryption scheme key that is used to encrypt and decrypt sensitive information from the database for the Blue Prism server connection.
• The password used to connect to the database if using SQL Authentication for database connections.

Expired and missing certificates

The expiry date for custom encryption certificates for Blue Prism application server configuration files can be found in the Environment Summary report, they are also written to Blue Prism event logs. In addition, when logging into Blue Prism, users are notified if a certificate used to encrypt the Blue Prism application server configuration files is due to expire within the next seven days.

If a certificate expires it will stop working with the Blue Prism application server. Certificate encryption may also stop working in the following circumstances:

• The user account running the server doesn’t have access to the public and/or private key. In this instance, a message displays asking the user to reset the configuration.
• The certificate used for encryption is now missing from the certificate store.
• The user account no longer has access to the local computer certificate store. In this instance, an error will display at start up when trying to load the certificate.

If the certificate used for encryption cannot be accessed or restored the user configuring the Blue Prism server will need to recreate the server configuration profiles. To do this, delete the Automate.config file, which is located in: ProgramData\Blue Prism Limited\Automate V3. A new Automate.config file will be automatically created when the BPServer.exe is launched. An encryption scheme and new certificate can then be applied to the new server configuration file.

The default installation of Blue Prism creates a Blue Prism Server service which is configured to use the server settings profile named Default. If a profile of a different name has been used, the server configuration utility can be used to create a Windows service associated with the custom profile.

The Windows service should be configured from the Windows Services management console on the local device. The main settings to be configured are:

• Startup type – By default this is set to Manual however it is recommended that for most environments it should be set to Automatic.
• Log On – The default account used by Blue Prism is Local System however this can be configured to be custom account.
  
  Where Windows Authentication is used for the Blue Prism Server profile to communicate with the database, it is the account specified here that will be used by the service when connecting to the database.

When SQL is secured using Windows Authentication, the configured Windows Service account will need to have appropriate (minimum) access to the SQL database.
When Blue Prism is configured to use Active Directory, the configured Windows service account will need to have appropriate permissions to access the directory services provider and query users and group membership. The specific permissions that are required in relation to Active Directory will be dependent on environmental factors and therefore assistance from the Active Directory administrator team within the target environment is likely to be required.

When starting the service, if it won’t start or if it stops immediately, it can indicate a configuration problem. Check the Blue Prism Application Log within Windows Event Viewer for additional information about the problem.

Use the Blue Prism Server configuration utility to re-validate the service configuration.

Common configurations such as where Blue Prism is configured to use Windows Authentication to authenticate against SQL may result in an error. This can occur if a non-admin user has been configured as the service log on account. In such situations, alerts similar to the below may be presented:

The Manage Permissions functionality can be used to grant the service account the appropriate permissions to listen on the defined port. The following rules must be considered:

• If the service is configured to use a binding, a specific address permission must be created.
• If the service is not configured to use a binding, a non-specific address permission must be used.

It is not possible to use an address containing a strong wildcard if the service will be using a defined binding.

Use the Windows Services management console to start the service.

If the service will not start, or starts and then immediately stops there is a problem with the configuration of the service. For more information, review Troubleshooting an installation.

The server service can be tested locally by configuring an additional Blue Prism connection on the local device that is configured to connect via the newly configured server service.

1. Launch Blue Prism and click Configure connection.

   

2. This will open the Connection Configuration Dialog where you can provide the connection information:

   • Connection Name – Friendly name for the connection.
   • Connection Type – Select Blue Prism Server from the drop-down.
   • Blue Prism Server – Hostname of the Blue Prism server. Must match the server binding, and be resolvable.
   • Connection Mode – Connection mode to use. This must match the mode configured on the Blue Prism Server.
   • Server Port – The port that the server is listening on.

   • Ordered Sessions – This is enabled by default and controls whether WCF connection sessions must be transmitted in order or not. Disabling this setting will reduce the amount of time a Blue Prism interactive client takes to connect to a large number of runtime resources.

   • Kerberos Realm –This must match the Kerberos realm of the service account running the Blue Prism Server(s). This must be configured for each BP Server connection in the interactive client.

   • Force NTLM – This forces New Technology LAN Manager (NTLM) authentication to be used for a connection for which a Kerberos realm has been set in the event that Kerberos authentication is not successful.

     

3. Click Test Connection to verify that a connection can be established.

   If the connection cannot be verified, this indicates that there is a problem with establishing a connection with the application server. For more information see Troubleshooting an installation and Troubleshooting the application server connection.
   

   Administrators can now use the two connections configured in the local Blue Prism client to validate:

   • Direct connections to the Blue Prism database.
   • Connections to the environment via the application server.

If using the following connection modes with a Blue Prism Server connection, a Service Principal Name (SPN) must be configured against the Active Directory (AD) account under which each Blue Prism Server service instance is running:

• WCF: SOAP with Message Encryption & Windows Authentication
• WCF: SOAP with Transport Encryption & Windows Authentication

• .NET Remoting Secure

This is because when a Blue Prism interactive client or a runtime resource connects to an application server using one of the connection modes above, the Microsoft Negotiate Security Package is used to select the best Security Support Provider (SSP) to authenticate the connection. The internal code of the Blue Prism interactive client provides the expected SPN to the Microsoft Negotiation Security Package, which prompts Microsoft Negotiation to select the Kerberos SSP over New Technology LAN Manager (NTLM) SSP, provided the SPN is present in Active Directory. If the SPN is not present in Active Directory, and if the Force NTLM option is enabled on the Connection Configuration screen in Blue Prism, the NTLM SSP will be used.

It is recommended to contact your organization's IT team for assistance with this configuration, and that you first test the configuration in a non-production environment.

This configuration applies to all Blue Prism environments, however, if the Active Directory account under which your BP Server instances are running resides in a different domain to the Active Directory account used for the Blue Prism interactive client and runtime resource, the additional configuration outlined below is required.

To configure the SPN, follow the steps below on each Blue Prism Server Service instance:

1. Log into the Blue Prism Server using a Privileged Windows User Account that is a member of the Domain Admins or Enterprise Admins group.

   See the Microsoft documentation in this topic for further details including required permissions. This is an essential step to review with your organization's IT team to ensure that the Setspn command does not fail to execute due to missing account permissions.

2. Open Command Prompt as an administrator on the application server and run the command below.

   If the Blue Prism Server is running as a Local System account:

   Copy

   Setspn -S HTTP/SERVER_FQDN:SERVER_PORT/BPServer COMPUTER_HOSTNAME 

   If the Blue Prism Server is running as a user account:

   Copy

   Setspn -S HTTP/SERVER_FQDN:SERVER_PORT/BPServer DOMAIN\Username

   Where:

   • HTTP accounts for both HTTP and HTTPS. Do not change the command to include HTTPS specifically as the configuration will fail.
   • SERVER_FQDN:SERVER_PORT must be the Fully Qualified Domain Name (FQDN) of the Blue Prism application server.
   • COMPUTER_HOSTNAME is the hostname of the computer if BP Server Service is running as a Local System account.

   • DOMAIN\Username is the domain username if BP Server Service is running as a user account.

     This should match the Log on as setting in the Blue Prism Server Properties (Local Computer) window.

     

   Example with local system:

   

   Example with DOMAIN\Username:

   

3. After setting the SPN you will need to wait for the Kerberos ticket cache to renew (the default setting is 15 minutes, but it can be changed via Group policy). For more details, see the Kerberos authentication documentation.

   Alternatively, you can either:

   • Restart the Blue Prism interactive client or runtime resource; or

   • On the machine running the interactive client or runtime resource, open Command Prompt and run Klist purge to refresh the Kerberos tickets.

     This command should not be performed within an elevated Command Prompt as it will not purge all the user Kerberos tickets.

4. Check that this is working as expected by connecting to the Blue Prism Server from a Blue Prism interactive client running on another machine.

5. Repeat the steps above on each instance of the Blue Prism Server Service running on every Blue Prism Server.

Check SPN entries and remove an incorrect SPN

1. To check SPN entries for troubleshooting purposes, you can see a list of the added SPNs on the application server using the following command:

   Copy

   Setspn -L ACCOUNTNAME

Example of SPN list:



2. Check the entries for the SPNs you added for the BP Server Service. You can remove the one added in error using the command listed below:

   Copy

   Setspn -D SPN_NAME ACCOUNTNAME

   Where SPN_NAME is the name displayed in the SPN entries list, for example, HTTP/SERVER_FQDN:SERVER_PORT/BPServer.

Additional configuration for Blue Prism application servers in load balanced environments

It is essential that all instances of the Blue Prism Server Service in the same load balancer pool are running under the same service account and the SPN is registered to this account.

Additionally, it is recommended to register SPNs for the application server's FQDNs to the same service account, as this will allow for testing of a direct connection to the application servers. For more information, see SPN troubleshooting.