What permissions and API calls are required for an Azure Key Vault setup?
Overview
This article details the Orchestrator credential store registration and Azure permissions associated to creating an app registration and key vault. Other credential stores will have similar permission requirements.
Note that the key vault user permissions are associated to the vault creator/owner and are granularly configurable using an Azure RBAC or Key Vault access policy to meet your needs.
The following screenshots are current as of November 2023 in Orchestrator version 2022.10.4.
Configuration Details
Credential store registration in Orchestrator
Azure app registration
Azure key vault details
Key vault access configuration
Azure key vault access policies summary
Azure vault app access policies
- Secret: Get, List, Set, Delete, Recover, Backup, Restore
Azure vault user (owner) access policies
- Key: Get, List, Update, Create, Import, Delete, Recover, Backup, Restore, Get Rotation Policy, Set Rotation Policy, Rotate
- Secret: Get, List, Set, Delete, Recover, Backup, Restore
- Certificate: Get, List, Update, Create, Import, Delete, Recover, Backup, Restore, Manage Contacts, Manage Certificate Authorities, Get Certificate Authorities, List Certificate Authorities, Set Certificate Authorities, Delete Certificate Authorities
Azure Graph API delegated permissions (User.Read)
Secret created in Azure KV (user1)
Orchestrator asset created in Azure KV
Related Orchestrator APIs with example response details:
/odata/CredentialStores/UiPath.Server.Configuration.OData.GetDefaultStoreForResourceType(resourceType='RobotCredential')
{
"@odata.context": "https://orchestrator.local/odata/$metadata#Edm.Int64",
"value": 3
}
/odata/CredentialStores/UiPath.Server.Configuration.OData.GetDefaultStoreForResourceType(resourceType='AssetCredential')
{
"@odata.context": "https://orchestrator.local/odata/$metadata#Edm.Int64",
"value": 3
}
/odata/CredentialStores
{
"@odata.context": "https://orchestrator.local/odata/$metadata#CredentialStores/$entity",
"HostId": null,
"HostName": null,
"Name": "AzureKeyVault-Prod",
"Type": "AzureKeyVault",
"AdditionalConfiguration": "{\"ClientId\":\"0494b782-d7f7-4bc5-9250-df96ab809080\",\"ClientSecret\":\"\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\",\"DirectoryId\":\"d8353d2a-b153-4d17-8827-902c51f72357\",\"KeyVaultUri\":\"https://acorchusmarvels.vault.azure.net/\"}",
"Id": 3,
"Details": {
"IsReadOnly": false
}
}
/odata/Assets(2)?$expand=UserValues
{
"@odata.context": "https://orchestrator.local/odata/$metadata#Assets(UserValues())/$entity",
"Name": "KV_Test",
"CanBeDeleted": true,
"ValueScope": "PerRobot",
"ValueType": "Credential",
"Value": null,
"StringValue": "",
"BoolValue": false,
"IntValue": 0,
"CredentialUsername": "",
"CredentialPassword": "",
"ExternalName": "",
"CredentialStoreId": null,
"HasDefaultValue": false,
"Description": null,
"FoldersCount": 1,
"LastModificationTime": "2023-11-27T21:43:59.443Z",
"LastModifierUserId": 3,
"CreationTime": "2023-11-27T18:49:08.247Z",
"CreatorUserId": 3,
"Id": 2,
"KeyValueList": [],
"Tags": [
{
"Name": "poc",
"DisplayName": "PoC",
"Value": "",
"DisplayValue": null
},
{
"Name": "sfdc_user",
"DisplayName": "SFDC_user",
"Value": "user1",
"DisplayValue": "user1"
},
{
"Name": "sfdc_pass",
"DisplayName": "SFDC_pass",
"Value": "p@ssw0rd1",
"DisplayValue": "p@ssw0rd1"
}
],
"UserValues": [
{
"UserId": 6,
"UserName": "User1",
"MachineId": 6,
"MachineName": "orchestrator.local",
"ValueType": "Credential",
"StringValue": "",
"BoolValue": false,
"IntValue": 0,
"Value": "username: orchestrator\\user1",
"CredentialUsername": "orchestrator\\user1",
"CredentialPassword": "",
"CredentialStoreId": 3,
"ExternalName": null,
"Id": 3,
"KeyValueList": []
}
]
}
/odata/Assets/UiPath.Server.Configuration.OData.GetFiltered?$top=10&$orderby=Name%20asc
{
"@odata.context": "https://orchestrator.local/odata/$metadata#Assets",
"@odata.count": 1,
"value": [
{
"Name": "KV_Test",
"CanBeDeleted": true,
"ValueScope": "PerRobot",
"ValueType": "Credential",
"Value": null,
"StringValue": "",
"BoolValue": false,
"IntValue": 0,
"CredentialUsername": "",
"CredentialPassword": "",
"ExternalName": "",
"CredentialStoreId": null,
"HasDefaultValue": false,
"Description": null,
"FoldersCount": 1,
"LastModificationTime": "2023-11-27T21:43:59.443Z",
"LastModifierUserId": 3,
"CreationTime": "2023-11-27T18:49:08.247Z",
"CreatorUserId": 3,
"Id": 2,
"KeyValueList": [],
"Tags": [
{
"Name": "poc",
"DisplayName": "PoC",
"Value": "",
"DisplayValue": null
},
{
"Name": "sfdc_user",
"DisplayName": "SFDC_user",
"Value": "user1",
"DisplayValue": "user1"
},
{
"Name": "sfdc_pass",
"DisplayName": "SFDC_pass",
"Value": "p@ssw0rd1",
"DisplayValue": "p@ssw0rd1"
}
]
}
]
}