Integrate with CyberArk · WorkFusion Documentation

The page covers details of WorkFusion integration with CyberArk products.

CyberArk Application Access Manager

note

Since v9.1

The integration enables the storage of automated application passwords and RPA bot passwords in CyberArk AAM.

Prerequisites

CyberArk components installed:

CyberArk Vault
CyberArk PrivateArk
CyberArk PAS (web API)
CyberArk AIM (Central Credential Provider + Central Credential Provider Web Service)

CyberArk is integrated into the infrastructure:

Credentials for the automated application are stored in CyberArk safe
Credentials for RPA bot users are stored in CyberArk safe

tip

For details, refer to CyberArk AAM documentation.

WorkFusion configuration:

The Bot Master user is reserved for the startup of the bots and supports the standard Windows authentication mechanism.
WorkFusion servers are authorized to access CyberArk AIM Web Service

Automate application integrated with CyberArk

Use case: the application being automated is already integrated with CyberArk. In order to access it, RPA bot logic needs to retrieve the password from CyberArk.

To retrieve credentials in bot config, a call to CyberArk API needs to be performed as in the example below.

Expand to see sample bot config

<config xmlns="http://web-harvest.sourceforge.net/schema/1.0/config" scriptlang="groovy">

    <var-def name="responseJson">
        <json>
            <http-extended
                    url="https://cyberarkserver:port/AIMWebService/api/Accounts?AppID=WorkFusion&Object=WF-Bot1-Test&Safe=WorkFusion%20Bot"
                    method="GET">
            </http-extended>
        </json>
    </var-def>

    <script><![CDATA[
        // WARN: this line is printing CyberArk response to log. Use for initial testing only.
        // TODO: replace with actual logic parsing json response.
        log.warn("$responseJson");
    ]]></script>

    <export include-original-data="false">
    </export>
</config>

Store RPA infrastructure passwords in CyberArk

Use case: Windows passwords to RPA bot machines are to be stored in CyberArk.

Only bot agents' passwords can be stored in CyberArk. The Bot Master user needs to support the standard authentication mechanism.

Bot Master user is a "patient 0" which will invoke CyberArk API, retrieve credentials to individual RPA bots, and initiate the startup of the RPA bots.

In the default setup, there is one bot master on each RPA server.

Enable certificate-based authentication with shared user (mTLS)

Log in to an RPA machine as Bot Master and download the certificates provided by CyberArk AIMWebService. Follow the steps below to install the certificate to the RPA machine.

Open Run (Windows+R) and execute mmc (Microsoft Management Console).
In the MMC application, click on File > Add/Remove Snap-in (Ctrl+M).
Select Certificate in the left column.
Select Computer account in the popup.
Click Next and then OK to create Certificates for your local computer.
Expand Trusted Root Certification Authorities inside the Certificates folder and right-click on Certificates to import the root certificate provided.
Expand Personal inside the Certificates folder and right-click on Certificates to import the PFK file.
Right-click on the imported certificate and select Open.
Navigate to the Details tab and note down the value for Thumbprint. This will be used while connecting to the CyberArk service from the PowerShell script you are going to create.

Retrieve credentials from CyberArk using PowerShell

Bot Master will retrieve credentials from CyberArk using PowerShell.

First, the script needs to be written and tested with pure PowerShell.

Example variables and parameters:

param([string] $baseURL, [string] $appId, [string] $safe, [string] $objectName, [string] $certificateThumbprint)

# Variables
$serverAddress = 'localhost'

# Param example
#$baseURL = 'https://cyberarkserver:port'
#$appId = 'WorkFusion'
#$safe = 'WorkFusionBot'
#$objectName = 'WF-Bot-Test'
#$certificateThumbprint = '023A534542CB2454'

Create a header object to set Content-Type.

$headers = New-Object "System.Collections.Generic.Dictionary[[String],[String]]"
$headers.Add('Content-Type','application/x-www-form-urlencoded')

Set security settings for an HTTPS request.

[Net.ServicePointManager]::SecurityProtocol = "tls12, tls11, tls"

Retrieve the added certificate using the passed certificate thumbprint.

$cert = Get-ChildItem -Path Cert:\CurrentUser\My\$certificateThumbprint

Make a GET request to CyberArk.

$response = Invoke-WebRequest "$baseURL/AIMWebService/api/Accounts?AppID=$appId&Safe=$safe&Object=$objectName" -Method 'GET' -Headers $headers -Certificate $cert

Convert the response content to a JSON object.

$responseObj = $response.Content | ConvertFrom-Json

Cache credentials in the Windows security storage for the server.
```
cmdkey /add:$serverAddress /user:$userName /pass:$password
```
Start an RDP session.
```
mstsc /v:$serverAddress
```

Use the PowerShell script to start bot agent RDP session

To configure a bot agent to use credentials from CyberArk, do as follows.

Modify the following configuration in {INSTALL_DIR}\wfagent\conf\wfagent-hub.yml for 9.x, and {INSTALL_DIR}\bot-agent\conf\bot-agent-master.yml for 10.x.

Configuration to modify:
```
  - id: rdp0
    expression: "cmd /c start /wait node0.RDP"
    directory: "rdp"
    enabled: "${environment.node0_enabled:true}"
```

Place the PowerShell script created in the previous step to {INSTALL_DIR}\wfagent\bin for 9.x, and {INSTALL_DIR}\bot-agent\bin for 10.x. The modified configuration will look like below.

Modified configuration:

  - id: rdp0
    expression: "cmd /c start /wait powershell .\\rdp_connection.ps1 -baseURL https://cyberarkserver:port -appId WorkFusion -safe WorkFusionBot -objectName workfusion-bot-1 -certificateThumbprint 023423AC43535BA23434"
    tag: "rdp"
    directory: "bin"
    enabled: "${environment.node0_enabled:true}"

note

The script can be placed wherever you wish inside wfagent/bot-agent. Make sure the directory is mentioned in the .yml file.

Perform these modification steps for each bot configuration with their corresponding CyberArk Object Name.