Orchestrator - Private Key Certificates

orchestrator

2020.10

false

Orchestrator user guide

Getting started
- Introduction
- Logging in to Orchestrator
- Resetting Your Password
- Robots
  - Robot Statuses
  - Robot Settings
Best practices
- Organization Modeling in Orchestrator
- Managing Large Deployments
- Automation Best Practices
Tenant
- About the Tenant Context
- Robots
- Folders
- About Users
- Roles
  - Default Roles
  - Managing Roles
- Machines
  - Managing Machines
- Packages
- Audit
- Credential Stores
- Webhooks
  - Types of Events
  - Managing Webhooks
- About Licensing
  - Activating Your License
  - Managing Your Licenses
- Alerts
  - Alert Emails
  - Setting Up Alert Emails
- Settings
Actions
- About Actions
- Managing Actions
Folders Context
- About the Folders Context
- Home
  - Overview
Automations
- About Automations
Processes
- About Processes
- Managing Processes
- About Recording
Jobs
- About Jobs
- Managing Jobs
- Job States
Triggers
- About Triggers
- Managing Triggers
- Using Cron Expressions
Logs
- About Logs
- Managing Logs in Orchestrator
- Logging Levels
- Orchestrator Logs
- Protecting Sensitive Information in Studio
Monitoring
- About Monitoring
- Machines
- Processes
- Queues
- Queues SLA
Queues
- About Queues and Transactions
- Managing Queues in Orchestrator
- Managing Queues in Studio
- Managing Transactions
  - Editing Transactions
  - Field Descriptions for the Transactions .csv File
- Review Requests
Assets
- About Assets
- Managing Assets in Orchestrator
- Managing Assets in Studio
Storage Buckets
- About Storage Buckets
  - CORS/CSP Configuration
- Managing Storage Buckets
- Moving Bucket Data Between Storage Providers
Orchestrator testing
- Test Cases
  - Field Descriptions for the Test Cases Page
- Test Sets
  - Field Descriptions for the Test Sets Page
- Test Executions
  - Field Descriptions for the Test Executions Page
- Test Schedules
  - Field Descriptions for the Test Schedules Page
- Test Data Queues
Action Catalogs
- About Action Catalogs
- Managing Action Catalogs
Profile
- About the Profile Page
- Managing Profile Settings
System Administrator
- About System Administrators
- Managing Tenants
- Field Descriptions for the Host Settings Page
- Maintenance Mode
Identity Server
- About Identity Server
- Identity Management Portal
- External Identity Providers
  - Field Descriptions for External Providers Page
- Installation Access Token
Authentication
- Configuring the Active Directory Integration
- Configuring SSO: SAML 2.0
  - ADFS Authentication
  - Google Authentication
  - OKTA Authentication
  - PingOne Authentication
  - Custom Mapping
  - Self-Signed Certificates
  - Private Key Certificates
- Configuring SSO: Google
- Configuring SSO: Azure Active Directory
- SmartCard Authentication
- Setting Up Auto Login for Users Under an Active Directory Group
- Configuring the SMTP Server
- Changing the Windows Authentication Protocol
Other Configurations
- Increasing the Size Limit of Package Files
- Opting Out of Telemetry
- Setting up Encryption Key Per Tenant
- GZIP Compression
Integrations
- About Input and Output Arguments
  - Example of Using Input and Output Arguments
Classic Robots
- Robots
- Environments
  - Managing Environments
- Jobs
- Triggers
- Monitoring
  - Robots
- Resources
Troubleshooting
- IE 11.0.9600.17031 Issues
- Frequently Encountered Orchestrator Errors
- Cron Expressions
- Upgrade Issues

Private Key Certificates

When configuring SAML 2.0 authentication, it is necessary to specify certain claims for the certificate provided by the identity provider. This is a step-by-step procedure on how to configure your Orchestrator instance to use a private key SAML certificate. The procedure begins with importing the certificate into the Windows Local Machine certificate store using Microsoft Management Console, and continues with the actual configuration steps required in Orchestrator/Identity Server.

Importing a Certificate in Windows

Go to Control Panel > Manage Computer Certificates. The console is displayed.
In the Console Root window's left pane, expand the Trusted Root Certification Authorities folder and then select Certificates.
Select Certificates and then select All Tasks > Import. The Certificate Import Wizard is displayed.
Make sure that Local Machine is selected in the Store Location section. Select Next.
Select Browse and select the certificate to upload.
Repeat this process for the Console Root / Personal folder.

Setting Orchestrator/Identity Server to Use the Certificate

Once the upload is complete, the certificate should be displayed in the console.
Double-click it. The Certificate dialog box is displayed.
On the Details tab, scroll through the list of fields and click Thumbprint.
Copy the hexadecimal characters from the box.
Remove the spaces between the characters. For example, the thumbprint "a9 09 50 2d d8 2a e4 14 33 e6 f8 38 86 b0 0d 42 77 a3 2a 7b" should be specified as "a909502dd82ae41433e6f83886b00d4277a32a7b" in Identity Server's Saml2 settings within External Providers page.

Note: When copied from the box on the Certificate window, the thumbprint contains several special characters that are only visible in ANSI encoding. Make sure to delete those using a suitable application such as Notepad++.

See below an example of getting a thumbprint ready for Identity Server's Saml2 settings within External Providers page.
In Identity Server's Saml2 settings within External Providers page, locate Signing Certificate section and set the following values for the attributes, as in the example below:
- Store name - select My from the drop-box
- Store location - select LocalMachine
- Thumbprint - enter the thumbprint value you've previously prepared.
  
  Read here how to access Identity Server.
Click Save to save the changes to the external identity provider settings.
Restart the IIS server after performing any configuration changes within Identity Server.

On this page

Importing a Certificate in Windows
Setting Orchestrator/Identity Server to Use the Certificate

Was this page helpful?

PREVIOUSSelf-Signed Certificates

NEXTConfiguring SSO: Google