Windows Service
Keeper Automator sample implementation on a Windows server
The instructions on this page are created for customers who would like to simply run the Automator service on a Windows server without Docker.
Make sure you already have your SSL Certificate! If not, please follow the steps in the Create SSL Certificate page.
(1) Install the Automator Service
On the Automator instance, download, unzip and run the Keeper Automator installer:
https://keepersecurity.com/automator/keeper-automator-windows.zip
In the setup screens, check the "Java" box to ensure that the Java runtime is embedded in the installation. Currently it ships with the Java 17 runtime, and this is updated as new versions are released.
This will install Keeper Automator into:
C:\Program Files\Keeper Security\Keeper Automator\
The configuration and settings will be set up in:
C:\ProgramData\Keeper Automator\
(2) Create the "config" folder
In the C:\ProgramData\Keeper Automator\ folder please create a folder called "config".
(3) Copy the certificate file and password file
Place ssl-certificate.pfx file (from the Custom SSL Certificate page) to the Automator Configuration settings folder in C:\ProgramData\Keeper Automator\Config
If your ssl-certificate.pfx file is protected by a passphrase, you also need to create a file called ssl-certificate-password.txt in the folder C:\ProgramData\Keeper Automator\Config
(4) Restart the Service
From the Services screen, select Keeper Automator and Restart the the service.
Confirm the service is running through a web browser (note that port 443 must be opened from whatever device you are testing) In this case, the URL is: https://automator.company.com/api/rest/status
For automated health checks, you can also use the below URL:
https://automator.company.com/health
Windows Firewall
If you are deploying on Windows running Defender Firewall, most likely you will need to open port 443 (or whatever port you specified) on Windows Defender Firewall. Follow these steps:
Open the Start menu > type Windows Defender Firewall, and select it from the list of results. Select Advanced settings on the side navigation menu... Select Inbound Rules. To open a port, select New Rule and complete the instructions.
Here's a couple of screenshots:
Final Configuration with Commander
Now that the service is running, you can integrate the Automator into your Keeper environment using Keeper Commander.
(5) Install Keeper Commander
On your workstation or server, install Keeper Commander CLI. The installation instructions including binary installers are here:
https://docs.keeper.io/secrets-manager/commander-cli/commander-installation-setup
(6) Login to Keeper Commander and activate the Automator using a series of commands, starting with automator create and name the automator whatever you want.
The Node Name (in this case "Azure Cloud") comes from the Admin Console UI as seen below.
The output of the command will display the Automator settings, including metadata from the identity provider.
Note that the "URL" is not populated yet. So let's do that next.
Run the "automator edit" command as displayed below, which sets the URL and also sets up the skills (team, team_for_user and device).
Next we exchange keys: The enterprise private key encrypted with the Automator public key is provided to Automator:
If an error is generated on this step, please stop and start the Windows service, and ensure that the port is available.
Next, initialize the Automator with the new configuration with the command below:
Lastly, enable the Automator service with the following command:
At this point, the configuration is complete.
For environments using AD FS ...
When activating Keeper Automator with AD FS as the identity provider, users will not be able to login until you update the Keeper certificate using the instructions below:
Login to the Keeper Admin Console
Go to Admin > SSO Node > Provisioning and then view the SSO Cloud configuration.
Click on "Export SP Cert".
In the AD FS Management Console select the Keeper Cloud SSO Relying Party Trust properties.
On the "Encryption" tab, replace the old certificate with this new cert.
On the "Signature" tab, Add/Replace the new SP certificate with this new cert.
Testing the User Experience
Now that Keeper Automator is deployed, you can test the end-user experience. No prompts for approval will be required after the user authenticates with the SSO identity provider.
The easiest way to test is to open an incognito mode window to the Keeper Web Vault and login with SSO Cloud. You will not be prompted for device approval.
Service Updates
When you reconfigure the Keeper Automator service, you'll need to use Keeper Commander to re-initialize the service endpoint.
Troubleshooting
Service not starting
Please check the Keeper Automator logs. This usually describes the issue. On Windows, they can be found in C:\ProgramData\Keeper Automator\logs\
Users always getting prompted for approval
When you reinstall the Keeper Automator service, you'll need to use Keeper Commander to re-initialize the service endpoint. (Keeper Commander documentation is linked here).
The commands required on Keeper Commander to re-initialize your Automator instance:
Last updated
