Introduction to the Credential Provider in the Server Installer

The Credential Provider in the Server Installer is a new feature that allows RPA deployments to retrieve database credentials from an external vault—such as HashiCorp Vault or CyberArk CCP—instead of embedding them directly in the connection string. This enhancement significantly improves security, adheres to best practices for secrets management, and modernizes the installation workflow.

What’s New?

In earlier RPA versions (e.g., 30.0.0), all connection strings were configured within a single screen, alongside optional Redis settings.

With the new update:

• The original screen now remains dedicated solely to Redis configuration.
• A new configuration screen has been introduced for each database, following the RPA database order:
  Automation, Knowledge, WordNet, Address, and Audit.
• Each database screen now supports enabling and configuring external vault integration.

This redesign improves modularity, separation of concerns, and clarity during installation.

Supported External Vault Providers

The Credential Provider currently supports:

These options allow organizations to adopt the authentication flow that best aligns with their security architecture.

Configuring Database Connections with an External Vault

The Server Installer provides step-by-step configuration flows for both HashiCorp Vault and CyberArk CCP. Below is a consolidated and clearer walkthrough based on the provided documentation.

Configuring a Database Connection with HashiCorp Vault

Before You Begin

• For AppRole authentication, ensure that you have an AppRole with access to the required secrets in Vault.

How to Enable HashiCorp Vault for a Database Connection

1. Launch the Server Installer and proceed to the database configuration screens.
2. In Connection String, enter the database connection string.
3. Check Get credential from provider.
4. In Address, enter the HashiCorp Vault API endpoint.
5. Set Provider to HashiCorp.
6. Choose the Authentication method:
   • AppRole
     • Enter Role ID
     • Enter Secret ID
   • Vault Proxy Auto-auth
     • No additional fields required.
7. Enter the Mount path where the secret is stored.
8. Enter the Secret path inside the mount.
9. Enter the Username key used in the secret for the username.
10. Enter the Password key used in the secret for the password.
11. Click Next.

Getting HashiCorp Vault data

HashiCorp data must be obtained from the previously configured environment. When configured via OpenShift, obtain the token from the Secrets Details page and use it to log in to the Vault.

In the configured secrets details, you can obtain the Mount path and Secret path data, as well as the Username key and Password key you want.

For the AppRole authentication method, you can also easily find the Role Id and Secret Id on the Secrets Details screen of OpenShift.

Configuring a Database Connection with CyberArk CCP

Before You Begin

• Ensure the CyberArk client certificate is installed in the truststore of the machine running the Server.

How to Enable CyberArk for a Database Connection

1. Launch the Server Installer and proceed to the database configuration screens.
2. Enter the database Connection String.
3. Check Get credential from provider.
4. In Address, enter the CyberArk CCP API endpoint.
5. Set Provider to CyberArk CCP.
6. Configure certificate-based authentication:
• Client Certificate Common Name (CN)
• Client Certificate Path
7. Enter the Application ID from CyberArk.
8. Enter the Safe name.
9. Enter the Account name.
10. Click Next.

Getting CyberArk Vault data

CyberArk data must be obtained from the previously configured environment. When configured via OpenShift, obtain the certificate data and the corresponding .crt file from the Secrets Details page.

Reusing Defined External Vault Settings

Overview

To reduce repeated manual entry across multiple databases, the installer allows reusing previously defined vault settings. As you progress through the database configuration screens, any database that already has vault details configured becomes available as a reference source.

Feature Availability

This feature aligns with the installer’s sequential workflow and is not available for the Automation database, since it is the first screen.

It becomes available for:

• Knowledge
• WordNet
• Address
• Audit

How It Works (Step-by-Step)

1. Launch the installer and proceed to the database configuration screens.
2. Configure the Automation database, optionally enabling credential provider settings.
3. Click Next to proceed to the next database.
4. In the next database screen:
• Enter the Connection String.
• Tick Get credential from provider.
• In the section Use provider settings from, select any previously configured database (only those with credential provider settings will appear).
• Click Apply, and the fields will be automatically populated.

This significantly reduces configuration time and eliminates the need to duplicate vault details across multiple databases.

Database Connection Validation

The Server Installer continues with integrated database connection validation, ensuring that:

• Credentials retrieved from the external vault are correct (if provided),
• The target database is reachable,
• The connection parameters are valid.

This prevents common misconfigurations and ensures a smoother installation experience.

Conclusion

The new Credential Provider functionality in the Server Installer represents a major enhancement in how RPA environments handle database credential management. By integrating with enterprise-grade vault solutions (HashiCorp Vault and CyberArk CCP), validating database connections, reorganizing the configuration flow, and allowing reuse of vault settings, the installer now offers:

• Stronger security
• Higher flexibility
• A more intuitive installation process
• Reduced manual configuration effort

For additional details and reference materials, consult the official RPA documentation.