Hub 4.6 – June 2022

Audit

The following enhancements have been made to the categories and events on the Audit page:

• Business process category:
  • Deleted Business process – This new event captures the required audit information when a business process is deleted.
  • Reactivated business process – This event was previously called Made active business process.
• Process definitions (only applicable if the ALM plugin is installed):

  • Deleted process definition – This new event captures the required audit information when a process definition is deleted.

  • Owner redacted process definition – This new event captures the required audit information when the process definition owner redacts the process.

• Interact - Forms category (only applicable if the Interact plugin is installed) – This category was previously called Interact.
  • Delete form – This existing event has been updated to included the deletion of form versions 0.0 and 0.1. Deleting these versions was not previously audited.
  • Edited form – This new event captures the required audit information when a form has been edited.
  • Increase major form – This event was previously called Form increase major.

The following audit events have been added to the Authentication management category on the Audit page:

• Native authentication enabled/disabled

• Windows authentication enabled/disabled
• Active Directory users created – This audits users added from Active Directory groups.
• Active Directory user created – This audits users added automatically to the database without any roles or users added by assigning them to roles directly in Hub.

• Updates to Active Directory users

• Active Directory synchronization started

• Active Directory synchronization completed

• Active Directory synchronization failed

• Active Directory domain added

• Active Directory domain deleted

• Active Directory domain updated

The following existing audit events have been renamed as follows:

• Made live authentication – LDAP configuration made live
• Edited authentication – LDAP configuration edited
• Deleted authentication – LDAP configuration deleted
• Authentication synced – LDAP configuration synced
• Authentication retired – LDAP configuration retired
• Authentication added – LDAP configuration added

The Active Directory security groups associated with a role that has been created, changed, or deleted now also display when viewing the audit log for such an event. The security group entry shows the SID (Security Identifier) and DN (Distinguished Name).

Authentication settings

The Authentication settings page in Hub has been updated to display all available authentication methods: native, Active Directory, and LDAP authentication. Previously, only LDAP authentication could be configured on this page.

Hub administrators can enable/disable these authentication methods as follows:

• Native authentication is enabled by default in new environments or when upgrading Hub, however it can be disabled if there is at least one Hub administrator in the system who can sign in using LDAP or Active Directory authentication.

• Both native and Active Directory authentication can be disabled if there is at least one Hub administrator in the system who can sign in using LDAP authentication.
• If there are no LDAP users in the system, either native or Active Directory authentication must be enabled, and at least one Hub administrator configured to use the enabled authentication type must be kept in the system.

• At least one LDAP connection must be added for LDAP authentication to be enabled.

The Hub administrator(s) must be able to use the currently enabled authentication type(s). A warning displays if there is no administrator configured to sign in using the currently enabled authentication type(s).

Authentication for Active Directory users in Hub now occurs as follows:

• Active Directory users configured in both Blue Prism and Authentication Server can now log into the Blue Prism interactive client using the Sign in using Authentication Server button on the interactive client login page. They will be directed to the Authentication Server login page where they can log in using a new Log in using Active Directory button without the need to re-enter credentials.
• Active Directory users configured only in Authentication Server can log into Hub directly using the new Log in using Active Directory button if Active Directory authentication has been enabled in Hub.
• Active Directory users that are not members of any Active Directory security groups or do not have any Hub roles assigned directly can still log into Hub but will be presented with a blank welcome page. This is to allow users who only have access to the Blue Prism interactive client to use Authentication Server as an authentication mechanism without accessing Hub.

LDAP users will still be prompted to re-enter their credentials.

The use of Active Directory authentication with the high availability configuration is not supported.

Role management of Active Directory users in Hub is carried out by enabling at least one of the following options on the Authentication settings page:

• Allow authorization via Active Directory security group membership – One or more Active Directory security groups can be added to a Hub role. Users who are members of these security groups are automatically added to the Hub role.
• Allow Active Directory users to be added directly to roles – One or more Active Directory users can be directly assigned to a Hub role.

If you are using Interact, please see the Interact 4.6 release notes for limitations regarding Active Directory security groups and Interact.

Active Directory domains

Hub administrators can now view, add, edit, and delete Active Directory domains and associated credentials securely stored in the Authentication Server database via a new Active Directory domains page, accessible by clicking View domains on the Authentication settings page.

Credentials are stored in the database when creating or editing an Active Directory domain. The username and password are encrypted before storage.

For more information, see Active Directory domains.

When searching Active Directory for users or security groups from within Hub, the credentials stored against the domain in the Authentication Server database are used. If no stored credentials are found, queries that require additional authentication will be executed under the context of the Windows account running the Authentication Server application pool in IIS.

The credentials stored against Active Directory domains in the Authentication Server database are used during the authentication of Active Directory users from those domains, to enable reading from the appropriate domain controller.

The stored credentials are used in the following scenarios:

• Hub – Active Directory users from a forest that is trusted by the forest of the Windows account running the Authentication Server application pool in IIS can now log into Hub via Authentication Server.
• Interact – Active Directory users from a forest that is trusted by the forest of the Windows account running the Authentication Server application pool in IIS, and who are members of Active Directory security groups assigned to Hub roles can now access the Interact application and plugin.
• Hub Control Room – Active Directory users from a forest that is trusted by the forest of the Windows account running the Authentication Server application pool in IIS, and who are members of Active Directory security groups assigned to Hub and Blue Prism roles can now access the browser-based Control Room.

Additional configuration is required in Blue Prism, please refer to the Blue Prism 7.1 release notes ( BP-6577).

Environment Manager

A new Edit button has been added to the database tiles on the Environment Manager page in Settings. This opens the Edit connection page. The connection information that can be edited is limited to the new API configuration section.

Users can now add API URLs to database connection configurations on the Environment Manager page. This is optional and allows users to access data via the Blue Prism API.

High Availability

The High Availability scripts have been updated for 4.6. They are available to download from the Blue Prism Portal.

Installer and upgrader

The Blue Prism API screen has been removed from the installer due to these settings being moved to the Environments screen in Hub.

An enhancement has been made to apply the IIS feature Windows Authentication to the Authentication Server. If this feature is not already installed, it will be installed by the MSI.

When the Hub installer or upgrader is run in Chinese, all of the screen titles now display correctly. Previously, some of the screen titles were truncated.

Roles and permissions

If Active Directory authentication is enabled in Hub, administrators can now assign one or more Active Directory security groups to a role in Hub by retrieving security groups from the Active Directory. One or more users or security groups can be assigned to the same role.

Active Directory users who have been assigned a Hub or Interact role from a security group, but do not have any direct roles assigned in Hub, are automatically assigned the Hub and Interact roles and their associated permissions.

User interface

The following design improvements have been made to the user interface:

• All pages in Hub now display a consistent title.
• Check boxes in grids have been replaced with icons.
• Rows per page selection now displays at the bottom of grids.
• When entering text into a text field, the number of remaining characters allowed displays under the text field.

The following changes have been made to the search field and filters in the following areas:

• A Username label has been added above the search field on the Users, Registrations, and LDAP> Configure user access and roles pages.
• A Role name label has been added above the search field on the Roles and permissions page.
• A Full name filter has been added to the filter drawer on the Users and Registrations pages.

Users

A new Authentication type field has been added to the Add user page in Hub. The available options for selection are Native authentication and Windows authentication. This field only displays if both native and Windows authentication have been configured in a Hub environment.

If Active Directory authentication has been enabled in Hub, administrators can add Active Directory users by selecting Windows authentication in the Authentication type field and searching the Active Directory. For more details, see Users.

The validation for Hub users has also been updated as follows:

• Usernames for Active Directory users (their UPN) can now contain up to 255 characters and support the following characters: {, @, }.
• Usernames for native users cannot exceed 25 characters in length and do not support the @ character.
• First names for all user types can be up to 28 characters in length.

A new Synchronize user option available for each Active Directory user record allows Hub administrators to synchronize a user's details with Active Directory. The following user details are updated: UPN, username, full name, email address, and status (active, deleted, or disabled).

Application

The Schedules and Tasks page has been replaced by two new pages:

• Schedule Activity – Allows users to monitor the status of each environment, filter data, and create user-defined views.

• Schedule Manager – Allows users to control, create, modify schedules, and manage activity with the help of user-defined views.

For more details, see Schedule Activity and Schedule Manager.

The Schedules Activity and Schedule Manager pages can only be accessed by users with the scheduler permissions enabled within their Blue Prism environment. Users without the correct permissions are notified, and prompted to contact their Blue Prism system administrator.

Details on a user's role and permissions are now stored in the browser to ensure permissions checks are more efficiently performed in Control Room. The data is refreshed frequently for enhanced security and to ensure any permission changes are immediately applied.

A breadcrumb trail has been added to all pages of Control Room, providing easier navigation between features.

New refresh options have been added to all tables in Control Room to give users more control over the refresh rate of table data. Each page now includes the following options:

• Auto refresh – Defines how often the table contents will automatically refresh. It is disabled by default, but can be set to every minute, five minutes, 10 minutes, or 30 minutes.

• Refresh now – Manually refreshes the table contents. If auto refresh is enabled, using this option will reset the timer.

• Last updated – Displays the date and time when the table was last refreshed.

Environment selection has been added to Control Room, enabling users to change environments, and API connections, from any page in Control Room. Environments must be pre-configured in Hub's Environment Manager, with a valid API URL.

Schedule Activity

The Schedule Activity page can now be filtered by schedule name and server name. Searches can be performed as exact matches, or by 'starts with'.

Columns in the Schedule Activity table can now be sorted in ascending or descending order. The default is to show the most recent items.

Schedule Manager

The following improvements have been made to schedule cards:

• The card size has been reduced to offer a more compact view of schedule details.

• Additional schedule details, such as recurrence type and expiry date, have been moved to a new View schedule details pane. Schedule cards now only include the schedule name, number of tasks, and retired status.

• Longer schedule names are now truncated and displayed with an ellipsis (...) when overflowing from the schedule card.

Users can now view and edit schedule details from the Schedule Manager page. This can be achieved by clicking the ellipsis ... button on the relevant schedule card and selecting View details or Edit. Users can also access the edit view from the Details section by selecting the Edit icon in the top of the pane.

Schedules can now be deleted by clicking the ellipsis (...) button on the relevant schedule and selecting Delete. This option only displays for users with the Delete Schedule permission.

Users can now view and edit schedule tasks by clicking the ellipsis (...) button on the relevant schedule card and selecting View tasks and sessions. Tasks can then be edited from the Tasks and sessions pane. The edit icon only displays for users with the Edit Schedule permission.

Users can now add and edit scheduled sessions by clicking the ellipsis (...) button on the relevant schedule card and selecting View tasks and sessions. Scheduled sessions can then be added by selecting the ellipsis button on the task and clicking Add session, and edited by selecting the edit icon. The edit icon only displays for users with the Edit Schedule permission.

Users can now configure start-up parameters when editing scheduled sessions from the Tasks and sessions pane. For improved usability, start-up parameters also include the relevant parameter type.

Users can now delete a schedule's tasks and sessions from the Tasks and sessions pane. This is accessed by clicking the ellipsis (...) button on the relevant schedule card and selecting View tasks and sessions. The delete icon only displays for users with the Delete Schedule permission.

Schedules can now be cloned by clicking the ellipsis (...) button on the relevant schedule, and selecting Clone. This option only displays for users with the Create Schedule and Edit Schedule permissions. When cloning a schedule, users can configure the details of the new schedule, and choose to retire the existing schedule if required and they have the relevant permissions.

A schedule that is running can now be stopped via Schedule Manager by clicking the ellipsis (...) button on the relevant schedule, and selecting Stop. This option only displays for users with the Edit Schedule permission.

Users can now edit the repeat configuration for schedules and define the parameters required for each recurrence type. This feature includes schedules that run once, minutely, hourly, daily, weekly, monthly, and annually.

Users can now retire and unretire schedules via the schedule cards. This can be achieved by clicking the ellipsis (...) button on the relevant schedule and selecting Retire or Unretire. These options only display for users with the Edit Schedule, Retire Schedule, and Create Schedule permissions.

The error message displayed when attempting to retire an already retired schedule has been improved to be clearer. Previously, the message only contained an error code.

An issue has been resolved where duplicate validation error messages displayed when attempting to configure a schedule with an expiry time before the start time. Now, only one error message displays.

Sessions

The Sessions table has been updated to display warnings on any sessions with the warning status. A status calculation query has been added to the table, ensuring that sessions with the warning status are correctly highlighted to users.

The Sessions table has been re-sized to improve usability and the visual presentation of the table data.

Calculation stages are now displayed as expected in session logs. Previously, calculation stages displayed fully capitalized in the Stage type column.

Error handling has been improved when a user attempts to navigate to an invalid session log parameter. Users are now redirected to the Sessions log page and informed by a toast message that the parameter does not exist.

Digital Worker Health

Users are now able to filter resources by retired status on the Digital Worker Health page. The default configuration is to display only unretired resources. For more details, see Digital Worker Health.

Work Queues

The Work Queues table has been re-sized to improve usability and the visual presentation of the table data.

Dashboard

The calculations used by the Monthly utilization diary have been improved to more accurately convert hours of activity and inactivity into percentages.