Providers/Provider name=”BeyondTrust”  

This credential provider includes the following parameters:

• *baseUrl - Enter the URL required to access the BeyondTrust server, according to the following pattern: 
  https://server/BeyondTrust/api/public/v3

Where server is the name of your server.

• Optional custom replaceable name/value pairs. You can define a value that is used throughout the BeyondTrust section and referred to by name in credential entries. The name must appear between braces when used. For example, by entering  UserName="Admin" in the provider element, the name can then be used Runas="{UserName}".

For BeyondTrust, you can use the following replaceable values:

• RobotName – The operator ID under which the robot is running.
• RobotIndex – In a multiple Robot Runtime system, the RobotIndex is assigned by the RPA Service.
• MachineName – The computer name.
• CurrentUser – The user who is currently logged in. You can only use this value for ASO Manager and Credential Store credentials.
• Workgroup – The work group that is assigned to the robot.
• AdapterFriendlyName – The application key that the ASO Manager or Credential Store  provides.

To use a replaceable value to provide an attribute, surround the name with braces. For example, to specify the applicationName parameter, use the following format:

applicationName="{AdapterFriendlyName}"

Credentials

Lists the individual credentials for BeyondTrust. When mapping individual credentials, use the following dynamic values, which are determined at runtime:

• {RobotName}
• {RobotIndex}
• {MachineName}
• {CurrentUser}
• {Workgroup}
• {AdapterFriendlyName}

For each credential, specify the following information:

• name – The reserved words RegistrationOperator, WindowUser, and RuntimeUser are all valid. The application keys specified by ASO Manager and Credential Store are also valid. Default can also be used for application credentials to provide a catch-all credential definition.
• systemName – Defines the BeyondTrust asset under which the credentials are stored.
• workgroup – Optional. If you do not specify a work group or no match is found, the system selects a credential with an empty work group.
• applicationName – Optional. If you specify an applicationName, this value must match an application defined in BeyondTrust. If you do not specify a value, the system uses the name attribute as the application name.
• accountNamePostfix – Optional. This value matches the end of an account name and provides a way to differentiate between account names contained by a single asset in BeyondTrust. Postfixes are removed from the account name in returned credentials.
• runas – A BeyondTrust user that belongs to a group that is authorized to access the credentials using the provided API key. If passwords are required, the runas user must be stored locally using the CredManagerUI application.
• APIGroup - The name of the API key that the CredManagerUI application stores locally. The API key must be authorized to retrieve this credential.

Credentials/Credential name="RegistrationOperator"

This credential retrieves the Registration Operator and is used by the RPA Service and Robot Runtime. The RegistrationOperator is a reserved name and can only appear once in the BeyondTrust section. Include the following information:

• systemName
• applicationName - must be RegistrationOperator
• runas
• APIGroup

Credentials/Credential name="RuntimeUser"

This credential retrieves the Windows user that is used to launch Robot Runtime. The RuntimeUser should only be specified when you want Robot Runtime to run under a credential that is not the same as the user who is logged in. This is a reserved name and is used only by the RPA Service. Include the following information:

• systemName
• workgroup – optional
• applicationName - must be RuntimeUser
• runas
• APIGroup

Credentials/Credential name="{ASOManager Key}"

Retrieves a credential for an application key defined in the ASO Manager. This application key is only used by Robot Runtime. Include the following information:

• systemName
• workgroup – optional
• applicationName
• accountNamePostfix – optional
• runas
• APIGroup

Credentials/Credential name="{CredentialStore Key}"

Retrieves a credential for an application key defined in the Credential Store. This application key is only used by Robot Runtime. Include the following information:

• systemName
• workgroup – optional
• applicationName
• accountNamePostfix – optional
• runas
• APIGroup

Credentials/Credential name="Default"

The Default credential matches when there is a credential request but no match with a credential name. This credential is only used by Robot Runtime. Include the following information:

• systemName
• workgroup – optional
• applicationName
• accountNamePostfix – optional
• runas
• APIGroup

Available in build 19.1.118 and later.

The following properties were added to the Provider element:

matchingMethod - Specifies the matching method for BeyondTrust accounts. Valid values for matching method are:

• Application - Matching by application name. (Default) 
• AccountName - Matching by account name, either full account name or account name keyword. (Recommended)

accountLimit - (optional) Indicates the number of accounts to retrieve with each BeyondTrust API request. If an account is not matched in the current batch, the system retrieves the next batch. The default batch size is 1000.

Here is an example of how you could set up a Provider element with these two properties:

<Provider name="BeyondTrust" baseURL=https://example.ps.beyondtrustcloud.com/BeyondTrust/api/public/v3 proxyAddress="" HttpClientTimeoutSeconds="100" matchingMethod="AccountName" accountLimit="1000" >

The following property was added to the Credential element for use with the AccountName matching method:

accountName - Only used if you chose the AccountName matching method. When an account name is matched, the account name that is returned has the matched part removed. The match text can include placeholders. The following keywords are supported:

• StartsWith(Value) - The value that the account name starts with.
• EndsWith(Value) - The value that the account name ends with. 
• Contains(Value) - A value contained in the account name. 
• EnclosedBy(Value1,value2) - The account name starts with value1 and ends with value2.
• Regex(Value) - A custom regex to match the account name with only one match group.

Here are some examples of how you could set up a Credential element with these properties. 

In this example, an account name that ends with "@Company" is used: 

<Credential name="RegistrationOperator" systemName="{MachineName}" runas="John" APIGroup="RPA" accountName="EndsWith(@Company)" />

In this example, the applicationName property is used:

<Credential name="WindowsUser" systemName="ROBOT1" workgroup="" accountNamePostfix="@{RobotIndex}" runas="user" APIGroup="apiGroup" applicationName = "WindowsUser"/>

• If the selection matching method is Application, you can match by using the accountNamePostfix and applicationName properties. 
• If the selection matching method is AccountName, you can match by using only the accountName property.

Credentials

Lists the individual credentials. With each credential request, all the dynamic values are sent. There are no required parameters values other than the name. The work group is only required to differentiate between credentials of the same type when they exist, for example, if you have two WindowsUser credentials.

Any name/value pair for the credential that you select is sent to the Client Credential Provider, along with the following dynamic values.

• {RobotName}
• {RobotIndex}
• {MachineName}
• {CurrentUser}
• {Workgroup}
• {AdapterFriendlyName}

Add name/value pairs as needed by your credential provider to identify the credential in your source system.

This credential retrieves the Windows user. The WindowsUser is a reserved name and is used only by the RPA Service.

To specify multiple WindowsUser accounts, use a WorkGroup value to differentiate between credentials.

This credential retrieves the Windows user that is used to launch Robot Runtime. The RuntimeUser should only be specified when you want Robot Runtime to run under a credential that is not the same as the user who is logged in. This is a reserved name and is used only by the RPA Service.

To specify multiple RuntimeUser accounts, use a WorkGroup value to differentiate between credentials.