topic RE: Unable to configure OS User Authentication with Cyber Ark VBO in Product Forum

Unable to configure OS User Authentication with Cyber Ark VBO

UditKhanna — Wed, 13 Apr 2022 14:51:00 GMT

Hi,

I downloaded the below DX asset and tried to access Cyber Ark safe from Blue prism and it worked fine as long as user level restriction was not applied at Cyber Ark end.

Once Cyber Ark team enabled user whitelisting, this particular asset stopped working and returned error:
Exception encountered while sending request
The remote server returned an error: (500) Internal Server Error

We were provided with couple of steps that was required to be added in the code stages in order to make OS user authentication work. However, we got the same error again.

Following were the steps:

request.PreAuthenticate = true;
and/or request.Credentials = CredentialCache.DefaultNetworkCredentials;

Has anyone else faced similar issue while setting up OS level user authentication?

------------------------------
Udit Khanna
------------------------------

RE: Unable to configure OS User Authentication with Cyber Ark VBO

PabloSarabia — Wed, 13 Apr 2022 15:29:00 GMT

Hi @UditKhanna

I didn't use Cyber Ark before. But usually, when you get an 500 http error, the problem is in the server that you call, not in the client. If you are failing with the authentication you will get an 401 unauthorized error or 403 forbiden error.

Did you check if You have any issue in the server or is responding well? Another test that You can make is to call the service with an external tool like SoapUi or Postman.

Hope this helps you.

See You in the Community, bye :)

------------------------------
Pablo Sarabia
Architect
Altamira Assets Management
Madrid
------------------------------

RE: Unable to configure OS User Authentication with Cyber Ark VBO

charliekovacs — Wed, 13 Apr 2022 19:26:00 GMT

Hi Udit,

Here are a few questions:
1. Are you making the call via SOAP? or REST?
2. Are you able to call the CyberArk endpoint successfully outside of Blue Prism? (eg. Postman)
3. Can you share an example of the error response you are receiving from CyberArk?

As Pablo mentioned, a 500 error would be a problem within CyberArk. But if the error is in the 400 range, then it is more likely a problem with how the authentication is being formed in the request coming out of Blue Prism. The integration has an output parameter that will contain the Request Data - that may help us troubleshoot if we can see what the request looks like.

------------------------------
Charlie Kovacs
Sr. Digital Exchange Engineer
Blue Prism
Austin, USA
------------------------------

RE: Unable to configure OS User Authentication with Cyber Ark VBO

UditKhanna — Thu, 14 Apr 2022 09:20:00 GMT

Thanks for the reply @charliekovacs. Following are the required answers:

1. SOAP
2. Yes
3. The remote server returned an error: (500) Internal Server Error

Value of Request Data :
URL: "CyberArk URL"

Method: POST
Timeout: 10000
Header: Content-Type: text/xml
Header: Host: "Host Name"

XML Body:

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:tem="https://tempuri.org/">
<soapenv:Header/>
<soapenv:Body>
<tem:GetPassword>
<tem:passwordWSRequest>
<tem:AppID>"Added APP ID Here"/tem:AppID>
<tem:Safe>"Added SAFE Here"</tem:Safe>
<tem:Folder>Root</tem:Folder>
<tem:Object>"Added object Query here"</tem:Object>
<tem:Username>"added username here"</tem:Username>
<tem:Address>.*</tem:Address>
<tem:PolicyID>"added policy id here""</tem:PolicyID>
<tem:ConnectionTimeout>30</tem:ConnectionTimeout>
<tem:Query>"Added object Query here"</tem:Query>
<tem:QueryFormat>Regexp</tem:QueryFormat>
<tem:Database>blueprism</tem:Database>

------------------------------
Udit Khanna
------------------------------

RE: Unable to configure OS User Authentication with Cyber Ark VBO

PabloSarabia — Thu, 14 Apr 2022 09:50:00 GMT

Hi @UditKhanna

I'm totally sure that the problem is in the Service that you are calling and not in the Blue Prism part.

Just to go one step back... Can you try to access the service using a common browser? (Not need to send nothing, just to check what happends) If you get an "Internal Application Error", you must to review this part first. (Maybe you miss any IIS configuration, or is an error with the Service configuration)

Bye :)

------------------------------
Pablo Sarabia
Architect
Altamira Assets Management
Madrid
------------------------------

RE: Unable to configure OS User Authentication with Cyber Ark VBO

SandeepSatish — Thu, 14 Apr 2022 10:46:00 GMT

Hi Pablo ,
This is the end point output. Blue prism is able to connect to cyberark as long as cyberark doesn't apply user level restriction. Once they apply user restriction, the internal server 500 is thrown at BP end.

Thanks
Sandeep S

------------------------------
Sandeep Satish
Asia/Kolkata
------------------------------

RE: Unable to configure OS User Authentication with Cyber Ark VBO

ewilson — Thu, 14 Apr 2022 14:37:00 GMT

@UditKhanna, @Sandeep Satish,

So we can assume the Digital Worker is running under a proper Active Directory user account, since you're basically trying to utilize SSO here?

Cheers,

------------------------------
Eric Wilson
Director, Integrations and Enablement
Blue Prism Digital Exchange
------------------------------

RE: Unable to configure OS User Authentication with Cyber Ark VBO

SandeepSatish — Fri, 15 Apr 2022 12:22:00 GMT

Hi , Yes. the VM server (Digital worker) is logged in with an actual AD user.

------------------------------
Sandeep Satish
Asia/Kolkata
------------------------------

RE: Unable to configure OS User Authentication with Cyber Ark VBO

ewilson — Sat, 16 Apr 2022 12:29:00 GMT

@UditKhanna, @Sandeep Satish,

As both Pablo and Charlie have mentioned, the HTTP 500 error is indicative of an issue on the server side.

The example code Udit provided in the original post is a valid example of how to associate the logged-in user's credentials with the request, although I'm not sure in pre-auth is really required.

I'd suggest working with your CyberArk administrator, and see if they can review the server-side logs to ascertain the nature of the HTTP 500 response.

Cheers,

------------------------------
Eric Wilson
Director, Integrations and Enablement
Blue Prism Digital Exchange
------------------------------

RE: Unable to configure OS User Authentication with Cyber Ark VBO

UditKhanna — Wed, 20 Apr 2022 17:06:00 GMT

Hi @PabloSarabia @Eric Wilson,

We worked with the Cyber Ark and we were able to fetch the server logs when the request is made.

Following is the log when the user level restrictions are not applied at the Cyber Ark end:

Good fetch logs
"[19/04/2022 | 12:11:37] | :: | APPAU005I Provider Prov_name has successfully fetched password [safe=Safe_Id] with query [Object=Object_Id] for application [App_Id] for IP address [Ip_address]. Fetch reason: []"

This call works fine without any error, however when the user level restrictions are applied, it is not able to get the OS User, and the OS User value is empty, below are the logs when we get an error while making the call:

Bad fetch logs
"[19/04/2022 | 12:25:40] | :: | APPAU006E Provider Prov_name has failed to fetch password with query [Object=Object_Id] for application [App_Id] for IP address [Ip_Address]. Fetch reason: []. Failure reason: [APPAP306E Authentication error for App ID [App_Id]. Reason: APPAP133E Failed to verify application authentication data: OSUser " "

------------------------------
Udit Khanna
------------------------------

RE: Unable to configure OS User Authentication with Cyber Ark VBO

charliekovacs — Mon, 25 Apr 2022 20:11:00 GMT

Udit,

Do you see a difference if you try to manually set the Windows credential in the CyberArk VBO code stage? The line would look something like this, replacing username, password, and domain (optional) with actual credential values for your environment:
request.Credentials = new NetworkCredential("username", "password", "domain");

If that does not work, I would question if the Windows credentials are getting dropped somewhere in IIS on the CyberArk side.

------------------------------
Charlie Kovacs
Sr. Digital Exchange Engineer
Blue Prism
Austin, USA
------------------------------

RE: Unable to configure OS User Authentication with Cyber Ark VBO

UditKhanna — Tue, 10 May 2022 11:18:00 GMT

Hi @charliekovacs, there is no difference when we try to manually set the Windows credential in the CyberArk VBO code stage. We tried the above solution and got the same Internal Server Error.

Following were the server logs we received from Cyber Ark when we sent the request :

"[10/05/2022 | 10:40:42] | :: | APPAU006E Provider Prov_name has failed to fetch password with query [Object=Object_Id] for application [App_Id] for IP address [Ip_Address]. Fetch reason: []. Failure reason: [APPAP306E Authentication error for App ID [App_Id]. Reason: APPAP133E Failed to verify application authentication data: OSUser " "

We have an ongoing case with CyberArk to check if the Windows credentials are getting dropped somewhere in IIS on the CyberArk side. Will get back with updates regarding it as well.

Thank You.

------------------------------
Udit Khanna
------------------------------

RE: Unable to configure OS User Authentication with Cyber Ark VBO

manavSingla — Tue, 17 May 2022 12:50:00 GMT

Hi @Charlie Kovacs do you have any findings from below logs as shared by @UditKhanna.Please let us know if any further inputs needed from our end for further analysis.

Thanks,
Manav Singla

------------------------------
manav Singla
------------------------------

RE: Unable to configure OS User Authentication with Cyber Ark VBO

charliekovacs — Tue, 17 May 2022 15:46:00 GMT

Hi Manav,

I think it will be important to determine if the credentials are being received in IIS on the CyberArk side.

This article from CyberArk might be of use:
https://cyberark-customers.force.com/s/article/How-Does-OS-User-Application-authentication-work-with-the-Central-Credential-Provider

------------------------------
Charlie Kovacs
Sr. Digital Exchange Engineer
Blue Prism
Austin, USA
------------------------------

RE: Unable to configure OS User Authentication with Cyber Ark VBO

manavSingla — Thu, 19 May 2022 09:28:00 GMT

Hi @Charlie Kovacs,

Do you have any workaround or procedure so that we can find if the credentials are being received in IIS on the CyberArk side or not.

Thanks,
Manav

------------------------------
manav Singla
------------------------------

RE: Unable to configure OS User Authentication with Cyber Ark VBO

manavSingla — Thu, 19 May 2022 09:31:00 GMT

Hi @Charlie Kovacs,

Do you have any workaround on how we can check if the credentials are being received in IIS on the CyberArk side or not.

Thanks,
Manav

------------------------------
manav Singla
------------------------------

RE: Unable to configure OS User Authentication with Cyber Ark VBO

charliekovacs — Thu, 19 May 2022 15:47:00 GMT

*edit* removing double post

RE: Unable to configure OS User Authentication with Cyber Ark VBO

charliekovacs — Thu, 19 May 2022 15:59:00 GMT

Manav,

I presume CyberArk will have the best advice for capturing that sort of information. I did find this article from CyberArk about gathering logs:
https://cyberark-customers.force.com/s/article/Enable-Debugging-and-Gather-Logs-Central-Credential-Provider

Aside from that, a tool like Fiddler can capture real time requests. IIS should produce some logging for each hosted site, and Event Viewer often captures some information as well.

The CyberArk article I shared in my previous reply indicates some requirements in IIS around Windows Authentication. It would be important to verify if that is configured properly. It claims request.UseDefaultCredentials is the only property needed to authenticate a request coming out of a .NET environment, so Blue Prism should be capable of sending a well-formed request. Whether that request is being handled in IIS appropriately with regard to Windows Authentication configuration could be the area to investigate.
https://cyberark-customers.force.com/s/article/How-Does-OS-User-Application-authentication-work-with-the-Central-Credential-Provider

------------------------------
Charlie Kovacs
Sr. Digital Exchange Engineer
Blue Prism
Austin, USA
------------------------------