Troubleshoot a Hub installation

Configure browsers for Integrated Windows Authentication

In the event that Active Directory users cannot log into Blue Prism Hub post installation, check that you have configured the supported web browsers  for Integrated Windows Authentication so that the currently logged-in users can be retrieved from the client machine. The configuration steps are different for each web browser supported by Hub.

Configure Google Chrome

1. Close any open instances of Chrome.

2. Open Registry Editor and enter the following in the top bar:

   Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome

3. Right-click the Chrome folder and select New > String Value.
4. Add the following string values: AuthNegotiateDelegateAllowlist and AuthServerAllowlist.
5. Right-click each string value in turn and select Modify.

6. In the Value data field for both string values, enter the host name of the Authentication Server website, for example, authserver.domain.com, and click OK.

   

Configure Microsoft Edge

1. Close any open instances of Edge.

2. Open Registry Editor and enter the following in the top bar:

   Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Edge

3. Right-click the Edge folder and select New > String Value.
4. Add the following string values: AuthNegotiateDelegateAllowlist, AuthServerAllowlist, and AuthSchemes.
5. Right-click each string value in turn and select Modify.
6. In the Value data field for AuthNegotiateDelegateAllowlist and AuthServerAllowlist, enter the host name of the Authentication Server website, for example, authserver.domain.com, and click OK.

7. In the Value data field for AuthSchemes, enter negotiate, ntlm and click OK. For more information, see the Microsoft documentation on Microsoft Edge policies.

   This string value is not required if your organization is only set up for Kerberos authentication, see below for more information.

   

Alternatively, you can follow these steps for Microsoft Edge:

1. Close any open instances of Edge.
2. Navigate to Control Panel > Network and Internet > Internet Options.
3. On the Advanced tab, under Security, select Enable Integrated Windows Authentication.
4. On the Security tab, click Trusted Sites > Sites.

5. In the Trusted sites dialog, enter the URL for Authentication Server (for example, https://authserver.domain.com) in the Add this website to the zone field and click Add.

   The URL displays in the Websites field.

   

6. Click Close.

7. On the Security tab in the Internet Options dialog, click Trusted Sites > Custom Level.

8. Under User Authentication > Logon, confirm that Anonymous logon is not selected. Instead, use any of the settings that allows the browser to pick up user credentials, as shown below.

   

9. Click OK.

Configure Kerberos authentication

The steps above will not suffice if Windows New Technology LAN Manager (NTLM) authentication has been disabled for your environment. In this case, you must also configure Kerberos authentication and a service principal name (SPN). Depending on your organization's setup, you might need to also add a Microsoft Edge WebView2 registry key. For more information, see the Microsoft documentation on NTLM and Kerberos authentication.

1. On the web server, open Internet Information Services (IIS) Manager.

2. From the list of connections, select Blue Prism - Authentication Server.

   This is the default site name – if you have used a custom site name, select the appropriate connection.

3. Under IIS, double-click Authentication.

   The Authentication page displays.

4. Select Windows Authentication (make sure it is set to Enabled) and then click Providers....

   The Providers dialog displays.

5. Add one or more providers from the list of available providers, based on your organization's setup, and click OK.

Configure service principal name (SPN)

A service principal name (SPN) will also need to be configured and registered for the Authentication Server URL to ensure Kerberos authentication works correctly. See the Microsoft documentation on this topic for further details, including required permissions. This is an essential step to review with your organization's IT team to ensure that the Setspn command does not fail to execute due to missing account permissions.

1. Open Command Prompt as an administrator on the web server and run the applicable command below.

   If the Blue Prism - Authentication Server application pool is running as a Local System account, use:

   Copy

   Setspn -S HTTP/WEBSITE_URL COMPUTER_HOSTNAME

   If the Blue Prism - Authentication Server application pool is running as a service account, use:

   Copy

   Setspn -S HTTP/WEBSITE_URL DOMAIN/Username

   HTTP covers both HTTP and HTTPS. Do not change the command to include HTTPS specifically as the configuration will fail.

2. Run Klist purge to refresh the Kerberos tickets.

3. Log into Authentication Server to verify that Kerberos authentication is working correctly.

Add a Microsoft Edge WebView2 registry key

If your organization is only set up for Kerberos authentication, and Authentication Server is also used to log into Blue Prism Enterprise, a registry key for the Microsoft Edge WebView2 browser must be added:

1. Close any open instances of Edge.

2. Open Registry Editor and enter the following in the top bar:

   Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Edge

3. Right-click the Edge folder and select New > Key.
4. Name the new key WebView2.
5. Right-click the WebView2 folder and add the following string values: AuthNegotiateDelegateAllowlist and AuthServerAllowlist.
6. Right-click each string value in turn and select Modify.

7. In the Value data field for AuthNegotiateDelegateAllowlist and AuthServerAllowlist, enter the host name of the Authentication Server website, for example, authserver.domain.com, and click OK.

   

Hub shows an error on starting

If a user logs into the Authentication Server, selects Hub and the following message displays:

An error occurred while starting the application

This means that the IIS sites need to be restarted. This error affects systems that are installed on a single server and occurs if RabbitMQ starts up after the IIS sites. Therefore, it is recommended that the IIS sites have a startup delay set on them to allow RabbitMQ to start up first.

If this error occurs, it can be resolved in the following way:

1. On the server, open Internet Information Services (IIS) Manager and stop all the Blue Prism sites. For a list, see Hub websites.
2. Restart the RabbitMQ Service.
3. Restart all Blue Prism application pools.
4. Start the Blue Prism sites that were stopped in step 1.

To delay the IIS sites service startup:

1. On the server, open Services.
2. Right-click World Wide Web Publishing Service and select Properties.
3. On the General tab, set Startup type to Automatic (Delayed Start).
4. Click OK and close the Services window.

Saving the SMTP setting returns an error when using OAuth 2.0

If you receive an error when saving a email configuration using OAuth 2.0, check that the Mail.Send permission is configured for the application in Azure Active Directory.

To add the Mail.Send permission:

1. In Azure Active Directory, open the application properties for the application that you are linking Hub to.
2. Click API permissions.

3. Click Add a permission.

   

4. In Select an API, under Microsoft APIs, select Microsoft Graph.

   

5. Under Microsoft Graph, click Application permissions.

   

6. Type Mail in the search field and press Enter.

7. Under the Mail list that is displayed, select Mail.Send and click Add permissions.

   

8. On the application permissions page, click Grant admin consent.

   

Updating the Customer ID after installation

If you need to enter or update your Customer ID after installation, you will need to update the License Manager appsettings.json configuration file. Once the configuration file has been updated, the License Manager must be restarted in Internet Information Services (IIS) Manager.

To update your Customer ID in the appsetting.json file:

1. Open Windows Explorer and navigate to C:\Program Files (x86)\Blue Prism\LicenseManager\appsettings.json.

   This is the default install location – adjust this if you have used a custom location.

2. Open the appsettings.json file in a text editor.

3. Locate the License:CustomerId section of the file and enter your new Customer ID, for example:

   Copy

   "License": {
       "CustomerId": "your-Customer-ID-here"
   }

4. Save the file.

To restart License Manager:

1. Open Internet Information Services (IIS) Manager.

2. In the list of connections, select Blue Prism - License Manager.

   This is the default site name – if you have used a custom site name, select the appropriate connection.

3. Click Restart from the Manage Website controls.

   

   The License Manager restarts.