Automation of workloads involving applications employing multi-factor authentication
A robotic process automation (RPA) system provides bots that interact with and provide user credentials to applications, such as for multi-factor authentication (MFA). First user credentials associated with MFA are retrieved by the bots from credential storage. Second user credentials that correspond to questions posed to a user of an application are retrieved from credential storage. Second user credentials that correspond to a one-time password are generated by the RPA system. The second user credentials may also be generated by a third-party authentication service that provides the credentials via a secondary channel such as email or SMS, which are then retrieved for presentation to the application.
1. A computer-implemented method for executing automation tasks, the method comprising:
storing a first user credential, for accessing a first application, to a credential storage, the first user credential corresponding to an initial credential required for a multi-factor authentication protocol implemented by the first application for a user to access the first application;
storing, for a robotic process automation system via at least one network, a bot that is configured to perform one or more programmed tasks, at least one or more of the programmed tasks including accessing the first application using the first user credential and a second user credential, and including interacting with the first application on behalf of the user;
deploying the bot to a client computing device via the at least one network, wherein the bot is configured to operate on the client computing device and initiate interaction with the first application;
receiving, from the bot operating on the client computing device, a first request for the first user credential;
responding to the first request from the bot by retrieving the first user credential from the credential storage and providing the first user credential to the bot;
subsequently receiving, from the bot operating on the client computing device, a second request for the second user credential; and
responding to the second request from the bot by obtaining the second user credential from the credential storage or a third party service, and providing the second user credential to the bot.
2. The computer-implemented method of claim 1 wherein the responding to the second request from the bot comprises retrieving the second user credential from the credential storage.
3. The computer-implemented method of claim 1 wherein the responding to the second request from the bot comprises generating a time-based one-time password from a key stored in the credential storage, wherein the time-based one-time password corresponds to the second user credential.
4. The computer-implemented method of claim 1 wherein the responding to the second request from the bot comprises retrieving the second user credential from a second application which has received the second user credential from the third party service.
5. The computer-implemented method of claim 4 wherein the method further comprises:
providing the second user credential to a mobile device associated with the first user wherein the second application executes on the mobile device to receive the second user credential from the third party service.
6. The computer-implemented method of claim 1 wherein the second user credential comprises an answer to a question posed by the first application.
7. The computer-implemented method of claim 1 wherein the responding to the second request from the bot comprises obtaining a time-based one-time code, wherein the time-based one-time password corresponds to the second user credential.
8. The computer-implemented method of claim 1 wherein the responding to the second request from the bot comprises obtaining the second user credential from the third party service.
9. The computer-implemented method of claim 8 wherein the third party service is an access management service.
10. A robotic process automation system, comprising:
data storage for storing at least:
a set of task processing instructions operable to interact at a user level with one or more user level applications, wherein the set of task processing instructions is encoded to interact with a multi-factor authentication provider; and
credentials, wherein at least some of the credentials are used to satisfy multi-factor authentication protocols required by the one or more user level applications;
a server processor operatively coupled to the data storage and configured to execute instructions that when executed cause the server processor to at least:
respond to a request to deploy the set of task processing instructions by deploying the set of task processing instructions;
respond to a first request from the set of task processing instructions operating on the client computing device to provide a first credential associated with a user to enable the set of task processing instructions to login to a first application, by retrieving from the data storage the first credential associated with the user that corresponds to the first application and providing the first credential to the set of task processing instructions; and
after responding to the first request, respond to a second request from the set of task processing instructions operating on the client computing device to provide a second credential associated with the user to enable the set of task processing instructions to login to the first application, by retrieving the second credential associated with the user that correspond to the first application and providing the second credential to the set of task processing instructions.
11. The robotic process automation system of claim 10 wherein the server processor responds to a second request by retrieving the second credential associated with the user that corresponds to the first application from the data storage and providing the second credential associated with the user to the set of task processing instructions.
12. The robotic process automation system of claim 10 wherein the server processor responds to a second request by retrieving the second credential from a second application which has received the second credential from a third party application and providing the second credential associated with the user to the set of task processing instructions.
13. The robotic process automation system of claim 12 wherein the server processor provides the second application to a mobile device associated with the user wherein the second application executes on the mobile device associated with the user to receive the second credential from the third party application.
14. The robotic process automation system of claim 12 wherein the retrieving the second credential from a second application comprises:
retrieving a user credential from the data storage;
accessing the second application with the user credential; and
retrieving the second user credential from the second application.
15. The robotic process automation system of claim 14 wherein the second application comprises an e-mail application.
16. The robotic process automation system of claim 14 wherein the second user credential comprises an answer to a question posed by the first application.
17. A non-transitory tangible storage medium, having stored thereupon one or more program modules comprising computer-executable instructions for execution on a computer system, the computer-executable instructions causing the computer system to:
operate a bot on a client computing device;
access, via the bot, a first application on behalf of a user, the first application configured to operate on the client computing device;
receive, from the bot operating on the client computing device, a first request from the first application for a first user credential of the user;
respond to the first request from the first application for a first user credential of the user by requesting the first user credential of the user that corresponds to the first application to be provided from a credential storage that securely stores user credentials for a plurality of users, and then providing the first user credential to the first application;
subsequently receive, from the bot operating on the client computing device, a second request from the first application for a second user credential; and
respond to second request from the first application for a second user credential of the user by requesting the second user credential of the user to be provided, and then providing the second user credential to the first application.
18. The non-transitory tangible storage medium of claim 17 wherein the second user credential is acquired by a second application, and then provided to the first application.
19. The non-transitory tangible storage medium of claim 17 wherein the first user credential and the second user credential together provide multi-factor authentication of the user to the first application.
20. The non-transitory tangible storage medium of claim 17 wherein the second credential corresponds to a one-time password.
21. The non-transitory tangible storage medium of claim 17 wherein the second user credential is acquired by a multi-factor authentication provider.
22. The non-transitory tangible storage medium of claim 21 wherein the second credential corresponds to a code transmitted via email by the multi-factor authentication provider to an email account associated with the first user, wherein the second application corresponds to an email application that operates the email account associated with the first user.
23. The non-transitory tangible storage medium of claim 21 wherein the second credential corresponds to a code transmitted via SMS by the multi-factor authentication provider to a mobile device associated with the first user, wherein the second application corresponds to a listener application executing on the mobile device associated with the user that recognizes an SMS message from the multi-factor authentication provider and extracts the second credential from the SMS message.
24. The non-transitory tangible storage medium of claim 21 wherein the multi-factor authentication provider is a network-based access management service provider.