Version: 10.3.1

Configure HashiCorp Vault for RPA

Get Vault token

To work with HashiCorp Vault (Vault below) after the Work.AI platform installation, go to the server where you deploy your Vault and get the Vault token: {DEPLOY_DIR}/vault/keys/vault_keys.json.

Vault token structure:

{
    "keys": [
      "fde831972c68746da5caf235a512ea06a4d1ea9bc7131d89445aecb5ea28725f52",
      "df4b0c5e3a9d1461be917c54eda4dd8470b91e518d7c95ca3978fce519b40dff02",
      "b39886cc2bc40fd18c9de87e99efd47e0b1e8911401c16876b6fc4557ec8e88693",
      "449c2afc42ad974721b158995a806f3673bb7f5a77057334539fd4aedeaf3f93ff",
      "825de25e569d9a95703c9718deb48a409ed1b505acf8520493a36a88075d6fe111"
    ],
    "keys_base64": [
      "/egxlyxodG2lyvI1pRLqBqTR6pvHEx2JRFrsteoocl9S",
      "30sMXjqdFGG+kXxU7aTdhHC5HlGNfJXKOXj85Rm0Df8C",
      "s5iGzCvED9GMneh+me/UfgseiRFAHBaHa2/EVX7I6IaT",
      "RJwq/EKtl0chsViZWoBvNnO7f1p3BXM0U5/Urt6vP5P/",
      "gl3iXladmpVwPJcY3rSKQJ7RtQWs+FIEk6NqiAddb+ER"
    ],
    "root_token": "s.JJ3zcUOsv4bSmgu6Xnb4Fa5v"
}

Take root_token and use it for the work with Vault.

Work with Vault from Bot configuration

The next example shows how to work with the Vault API from Bot configuration and put secrets into Vault or get secrets from Vault. For more information about Vault API, see this article.

Working with Vault API, fill data in the JSON format when you try to POST data to Vault.
When trying to GET data from Vault, get a response in the JSON format.

Expand to see the sample configuration

<?xml version="1.0" encoding="UTF-8"?>
<config xmlns="http://web-harvest.sourceforge.net/schema/1.0/config" scriptlang="groovy">
    <!-- APPLICATION TEST NAME ALIAS FOR VAULT -->
    <var-def name="application_name">
        <template>SAP</template>
    </var-def>
    <!-- CREATE TEST DATA FOR FILL SECRET INTO VAULT-->
    <script><![CDATA[
        credentials_map = [:];
        credentials_map["usr1"] = "pwdqwerty564@";
        credentials_map["usr2"] = "pwdzxcgfef875#";
        credentials_map["usr3"] = "pwdKLFJNemkfe%9";

        def credentials_json = groovy.json.JsonOutput.toJson(credentials_map);

        sys.defineVariable("credentials", credentials_json);
    ]]></script>
    <!-- FILL SECRET TO VAULT -->
    <var-def name="response">
        <try>
            <body>
                <http-extended url="https://{VAULT_HOST}:{VAULT_PORT}/v1/secret/${application_name.toString()}" method="post" content-type="application/json">
                    <http-header-extended name="X-Vault-Token">
                        <var-global name="vault_token"/>
                    </http-header-extended>
                    <var name="credentials"/>
                </http-extended>
            </body>
            <catch>
                {"status": "successful"}
            </catch>
        </try>
    </var-def>

    <script><![CDATA[
        println response;
    ]]></script>

    <!-- GET SECRET FROM VAULT -->
    <var-def name="response">
        <http-extended url="https://{VAULT_HOST}:{VAULT_PORT}/v1/secret/${application_name.toString()}" method="get" content-type="application/json">
            <http-header-extended name="X-Vault-Token">
                <var-global name="vault_token"/>
            </http-header-extended>
        </http-extended>
    </var-def>

    <script><![CDATA[
        println response;
    ]]></script>

    <export include-original-data="true"></export>
</config>

Work with Vault in PowerShell

PUT Secrets into Vault by ALIAS

# Create header object for set Vault token
$headers = New-Object "System.Collections.Generic.Dictionary[[String],[String]]"
$headers.Add('X-Vault-Token',{vault_token})


# Set security settings for HTTPS request
[Net.ServicePointManager]::SecurityProtocol = "tls12, tls11, tls"


# Make secret data for fill to the Vault
$body = '{"usr2":"pwdzxcgfef875#","usr3":"pwdKLFJNemkfe%9"}'

# make POST request with header where we set Vault token and body where we set data to fill into the Vault
$Response = Invoke-WebRequest 'https://{host}:{vault_port}/v1/secret/{secret_alias}' -Method 'POST' -Headers $headers -Body $body

# print response into console
echo $Response

GET Secrets from Vault by ALIAS

# Create header object for set Vault token
$headers = New-Object "System.Collections.Generic.Dictionary[[String],[String]]"
$headers.Add('X-Vault-Token',{vault_token})

# Set security settings for HTTPS request
[Net.ServicePointManager]::SecurityProtocol = "tls12, tls11, tls"

# make GET request with header where we set Vault token
$Response = Invoke-WebRequest 'https://{host}:{vault_port}/v1/secret/{secret_alias}' -Method 'GET' -Headers $headers

# print response into console
echo $Response


#convert Response content to JSON object
$aliasobj = $Response.Content | ConvertFrom-Json -AsHashtable;

# print passwords for users by user name
echo $aliasobj.data.usr1;
echo $aliasobj.data.usr2;
echo $aliasobj.data.usr3;

Start RDP with Vault credentials from command line

Start RDP in Powershell

To start RDP in PowerShell with the Vault credentials (rdp_connection.ps1), see the code below:

param([string] $vault_token, [string] $user_name, [string] $secret_alias)


# Create header object for set Vault token
$headers = New-Object "System.Collections.Generic.Dictionary[[String],[String]]"
$headers.Add('X-Vault-Token',{vault_token})

# Set security settings for HTTPS request
[Net.ServicePointManager]::SecurityProtocol = "tls12, tls11, tls"

# make GET request with header where we set Vault token
$Response = Invoke-WebRequest 'https://{host}:{vault_port}/v1/secret/{secret_alias}' -Method 'GET' -Headers $headers

#convert Response content to JSON object
$aliasobj = $Response.Content | ConvertFrom-Json -AsHashtable;

# get password for users by user name
$password = $aliasobj.data.$user_name;

# cache credentials in windows security storage for server
cmdkey /add:$server_address /user:$user_name /pass:$password

#start RDP session
mstsc /v:$server_address

Use RDP in Bot Agent

To use RDP with the Vault credentials in the Bot Agent, do as follows:

Edit the {INSTALL_DIR}/wfagent/conf/wfagent-hub.yml file. The code to edit is as follows:

  - id: rdp0
    expression: "cmd /c start /wait node0.RDP"
    directory: "rdp"
    enabled: "${environment.node0_enabled:true}"

Change each active RDP block in processes. The edited code is as follows:

  - id: rdp0
    expression: "cmd /c start /wait powershell rdp_connection.ps1 -vault_token ${vault_token} -user_name ${user_name} -secret_alias ${secret_alias}"
    enabled: "${environment.node0_enabled:true}"
    tag: "rdp"

Get Vault token​

Work with Vault from Bot configuration​

Work with Vault in PowerShell​

PUT Secrets into Vault by ALIAS​

GET Secrets from Vault by ALIAS​

Start RDP with Vault credentials from command line​

Start RDP in Powershell​

Use RDP in Bot Agent​