...
SaaS Implementation: Luma Automation cloud instance is implemented on Serviceiaide infrastructure and is maintained by the Serviceaide Support Team. The System Administrator can build and design Workflow services to connect to remote services and systems that can be accessed over the internet.
On-Premise Agent Implementation: The Automation Orchestrator component is deployed on the Customer’s local infrastructure within the customer network or private cloud. The Orchestrator allows integration with services that cannot be accessed outside the customer network, such as Active Directory (AD), On-premise servers.
On-Premise Agent Deployment Architecture
Below the On-Premise Agent deployment Architecture for Luma automation. The Orchestrator component deployed in customer network polls the Cloud instance over HTTPS/443 port for secure and encrypted communication. An outbound connection is only required to be open from the customer network. No inbound rules/ports are required.
...
Orchestrator Server Requirements:
Following are the server requirements for On-Premise Orchestrator (Agent) deployment:
CPU - 4 CPU
Memory - 12 GB
Hard Disk 500 GB HDD
Operating System CentOS-7 or RHEL 7
Installed Software - Java 8, MySQL
...
For HTTP/S : 80,443,8090
For SSH: 22
For Uptime: ICMP Ping Enabled
Integration with Active Directory
Serviceaide’s Luma Automation can be directly configured to reach out to AD Server if port 389 is open and available over the internet. If port 389 is not available over the internet and can be made only local, the automation orchestrator server is deployed on-premise which can connect to the local AD server on port 389. Luma Automation cloud instance connects to the Automation Orchestrator server over the internet.
...
Components | Requirements |
Port | AD Default Port: 389, 5985 or 5986 |
Access Account | User Account with Active Directory Admin Access |
Configuration | Port 389 389 port must be enabled and configured to connect from external systems |
Additional installations | WinRM to be installed on the AD Server |
Username | Active Directory Server Username |
Password | Active Directory Server Password |
Accessibility | Active Directory Server to be accessible/reachable from the Serviceaide Automation server setup in your environment. |
Configuring WinRM
Configuring WinRM is a pre-requisite on Windows AD Server. WinRM is a standard web services protocol used for remote software and hardware management. The WinRM service listens on the network for WS-Management requests and processes. WinRM works with HTTP and HTTPS.
Info |
---|
We would recommend the configuration of WinRM to use HTTPS. |
Configure WinRM to Use HTTP
You can configure the WinRM host to enable communication through the HTTP protocol. You must modify the WinRM configuration by running commands on the WinRM host machine. You can use the same machine as both the WinRM service and WinRM client.
...
Run the following command to set the default WinRM configuration values.
c:\> winrm quickconfig(Optional) Run the following command to check whether a listener is running, and verify the default ports.
c:\> winrm e winrm/config/listenerEnable basic authentication on the WinRM service.
Run the following command to check whether basic authentication is allowed.
c:\> winrm get winrm/configRun the following command to enable basic authentication.
c:\> winrm set winrm/config/service/auth @{Basic="true"}Run the following command to allow transfer of unencrypted data on the WinRM service.
c:\> winrm set winrm/config/service @{AllowUnencrypted="true"}
Enable basic authentication on the WinRM client.
Run the following command to check whether basic authentication is allowed.
c:\> winrm get winrm/configRun the following command to enable basic authentication.
c:\> winrm set winrm/config/client/auth @{Basic="true"}
Run the following command to allow the transfer of unencrypted data on the WinRM client.
c:\> winrm set winrm/config/client @{AllowUnencrypted="true"}If the WinRM host machine is in an external domain, run the following command to specify the trusted hosts.
c:\> winrm set winrm/config/client @{TrustedHosts="host1, host2, host3"}Run the following command to test the connection to the WinRM service.
c:\> winrm identify -r:http://winrm_server:5985 -auth:basic -u:user_name -p:password -encoding:utf-8
Configure WinRM to Use HTTPS
You can configure the WinRM host to enable communication through the HTTPS protocol. The WinRM host requires a certificate so that it can communicate through the HTTPS protocol. You can either obtain a certificate or generate one. For example, you can generate a self-signed certificate by using the Certificate Creation Tool (makecert.exe) that is part of the .NET Framework SDK.
Prerequisite
Verify that you can access the Microsoft Management Console (mmc.exe) on the WinRM host.
Procedure
Follow the below steps to Configure WINRM to use HTTPS:
...
Info |
---|
You may contact the Serviceaide support team for any assistance on On-Premise Agent implementation. Refer to ITAS On-premise Agent v1.1.0 Runbook to follow the deployment steps. |