HashiCorp Vault allows you to centrally manage your secrets keeping them safe and compliant. In this blog we'll show you how to integrate HashiCorp Vault with your IBM Robotic Process Automation tenant, saving you time by centralizing secret management whilst enhancing your security posture.

What are Credentials within IBM RPA?

Credentials are username and password pairs that can be retrieved at runtime to log in to Computers and used by IBM RPA commands within WAL scripts.

In this blog we're talking about System Credentials that can be found in the Credentials tab within the Control Center. These are credentials used by the whole tenant and not Vault Credentials which are stored in the IBM RPA Vault.

Integrating with HashiCorp Vault

For this blog we'll be using HashiCorp Vault Enterprise with AppRole authentication and the KV2 secrets engine. We expect that you already have this configured and can find more information in the HashiCorp documentation.

1. Create a secret in HashiCorp Vault

Below is an example of creating a new secret that we'll use in further steps. The name of the secret is example and it has 2 keys username and password. The values of those 2 keys will be what forms the Credential.

2. Gather required information from HashiCorp Vault

Now lets gather all the information required to create a Credential and Credential Provider. It is likely that you will just create a single Credential Provider and then reuse it for multiple Credentials.

Mount path and Secret path can be found on the main page for your created secret. The username and password keys are what we added above when creating the secret.

In this example we have the following information:

Mount path: secret/rpa

Secret path: example

Username key: username

Password key: password

3. Creating a Credential Provider

Credential Providers store all the information required for IBM RPA to connect to a third party provider like HashiCorp when retrieving Credential data.

To create a credential provider you need the permission to Manage credential providers. This will give you access to the credential provider page where you can manage your credential providers.

Enter the following fields:

Name: A friendly name that you can recognise.

Address: The URL to you HashiCorp Vault instance

Provider: HashiCorp

Authentication method: AppRole

Role Id: Available by using the Vault API or CLI

Secret Id: Available by using the Vault API or CLI

Feel free to explore other options available as Providers and Authentication methods. The Authentication methods available depend on which Provider you have selected.

4. Creating a Credential

To create a credential you need the permission to Manage credentials.

Enter the following fields:

Name: A friendly name that you can recognise.

Click "Using external provider"

Credential provider: The provider that we created in the previous step

Mount path, Secret path, Username key and Password key: Found in Step 2 above.

With the Credential created you're now ready to start using it throughout IBM RPA.

Using credentials in your automations

Credentials are mainly used when logging into computers to run scripts and during script execution. Once you have included them in your Computer or Script you're free to update the username and password without the need to update your scripts or computers.

Assigning a Credential to a Computer

When you create a new computer, or edit an existing one, simply select the Credential that uses your HashiCorp Vault Credential provider. The computer will reach out to your HashiCorp instance to retrieve the username and password when it wants to login.

Using a Credential within an IBM RPA Script

The getVaultItem command allows you to retrieve the username and password at runtime. This is particularly useful when your automations require logging in to a system or website.

Enter the Credential name and make sure to select System.

Here we assign the username and password to variables so that we can call on them in other commands.

Note that your IBM RPA clients must be using version 30.0.0 and above to be able to access credentials that have their data stored in a third party vault.

Migrating your existing Credentials

To avoid recreating your existing Credentials you can edit them and simply switch from "Using internal provider" to "Using external provider". Doing this will save you time and avoid needing to update all of your computers and scripts that call on system Credentials.

Summary

In this blog we have created a HashiCorp secret and then used it within IBM RPA by leveraging the new Credential provider concept. Our credentials now use this provider instead and are ready to be leveraged in our automations. Doing this has enhanced our security posture and simplified how credentials are managed across our organisation.

To find out about other Credential providers, like CyberArk CCP, visit our documentation.