Add applications and application configurations - Bastionhost

Bastionhost supports operations and maintenance (O&M) for applications. To manage an application, you must first add it to Bastionhost and associate it with an application server and remote client.

Prerequisites

You have added an application server. For more information, see Add and deploy an application server.
You have added a remote client. For more information, see Add a remote client.

Add an application

Log on to the Bastionhost console. In the top navigation bar, select the region where your Bastionhost instance is located.
In the list of Bastionhost instances, find the target instance and click Manage.
In the navigation pane on the left, choose Assets > Applications.

On the Applications tab, click Create Application. In the panel that appears, configure the parameters as described in the following table and click OK.

Parameter	Description
Application Name	A custom name for the application. The name must meet the following requirements: Must be 1 to 128 characters long. The name cannot start with a special character. The name can contain only periods (.), underscores (_), hyphens (-), backslashes (\), and spaces.
Application Server	Select the application server used to access the application. For more information about how to add an application server, see Add and deploy an application server.
Associate Remote Client	Select the remote client used to access the application. For more information about how to add a remote client, see Add a remote client.
Application Type	The system automatically identifies the application type based on the selected remote client.
Destination URL	The URL that automatically opens when an O&M session for the application starts. This parameter is available only when the remote client is Google Chrome or Mozilla Firefox.
O&M Access Rules	This parameter is available only when the remote client is Google Chrome. Only allow O&M access to URLs that have the same IP address or domain name as the destination URL: When this option is enabled, users can only access URLs that share the same IP address or domain name as the Destination URL, in addition to URLs on the whitelist. Blacklist/Whitelist: Specify a blacklist or whitelist for URLs. Example: Assume that you set the destination URL to `https://example.com`, enable the Only allow O&M access to URLs that have the same IP address or domain name as the destination URL option, and add `https://example.com/help` to the blacklist. In this case, an authorized O&M user cannot access the content in the `/help` directory of the website. Access to other resource paths is not affected.

Set up automatic logon

If the application is associated with a Google Chrome or Mozilla Firefox remote client, you can configure an autofill script for the browser. This allows you to store the web application's username and password in an application account to enable automatic logon during O&M sessions.

Note

Websites that use anti-bot logon detection do not support autofill for usernames and passwords.
For websites that require a verification code, you must enter the code manually after Bastionhost autofills your credentials to complete the logon.

Generate and configure the autofill script

Although the browser extension for generating the autofill script runs only in Google Chrome, the generated script works in both Chrome and Mozilla Firefox.

Log on to the Bastionhost console. In the top navigation bar, select the region where your Bastionhost instance is located.
In the list of Bastionhost instances, find the target instance and click Manage.
In the navigation pane on the left, choose Assets > Applications.
On the Applications tab, find the target application and click Edit in the Actions column.
On the Application Configurations tab, click Download the browser plug-in and decompress the downloaded file on your computer.
Import the downloaded extension to your browser. Follow the instructions provided by the extension to generate the script, and then paste it into the Autofill Script field.
In Google Chrome, go to the extensions page and add the decompressed extension folder (named extension).
After the extension is loaded, Bastionhost Web Configuration Generator 1.0 appears in the extension list. Make sure the toggle switch in the lower-right corner is enabled.
In Google Chrome, open the logon page of the web application for which you want to enable autofill. Click the extension icon and then click Start.
The following steps use the Alibaba Cloud RAM user logon page as an example:
In the extension pop-up, make sure that Configuration Type is set to Autofill.
Follow the prompts to capture the username input box, password input box, and logon button by using the extension.
- Capture the username input box
  On the logon page, right-click the username input box and select Bastionhost Web Configuration Generator > Add Username Input Box from the context menu.
- Capture the password input box
  On the RAM user logon page, click the Add Password Input Box button provided by the Bastionhost Web Configuration Generator extension in the lower-right corner of the page. This adds the password input box to the autofill script.
- Capture the logon button
  On the RAM user logon page, right-click the page to open the browser context menu. At the bottom of the menu, find the Bastionhost Web Configuration Generator extension item and click Add Logon Button.
After you capture all required elements, the script is automatically generated and copied to your clipboard. Return to the Application Configurations tab in the Bastionhost console, paste the script into the autofill script field, and click Update.

Troubleshooting

If you encounter issues downloading or configuring the application proxy plug-in (browser extension), try the following solutions in order:

Page fails to load or download fails: Refresh the page and try again.
Browser compatibility issues: If refreshing does not resolve the issue, switch to Google Chrome or Mozilla Firefox and try again.

Create an application account

Log on to the Bastionhost console. In the top navigation bar, select the region where your Bastionhost instance is located.
In the list of Bastionhost instances, find the target instance and click Manage.
In the navigation pane on the left, choose Assets > Applications.
On the Applications tab, find the target application and click Edit in the Actions column.
On the Application Account tab, click Create Application Account. In the panel that appears, set the username and password for the web application and click OK.

Related operations

Edit an application: To modify an application's configuration, such as its name or associated application server, find the application and click Edit in the Actions column.
Delete an application: If an application is no longer needed, find it and click Delete in the Actions column.

FAQ

Why does Bastionhost take me directly to the remote desktop instead of starting the specified application when I perform O&M on a Windows application server?

This issue usually occurs because the application does not have a valid Destination URL configured, or the application is not correctly associated with an application account. To resolve the issue, perform the following steps:

In the Bastionhost console, find the target application and click Edit in the Actions column. On the Application Configurations tab, enter a valid URL in the Destination URL field, for example, http://localhost or an intranet address.
On the Application Account tab, click Create Application Account to create an application account, and then grant the account to the corresponding user.
On the user's terminal, verify that the Bastionhost Assistant is installed and running.
Use Bastionhost to start the browser application. In the browser address bar, manually enter the VPC intranet URL of the application to access it.

Do RAM users support password-free automatic logon in Bastionhost?

RAM users cannot directly achieve automatic logon in Bastionhost. Before a RAM user can access resources through Bastionhost, an administrator must first import the RAM user into Bastionhost and complete the required asset and account authorization.

Note the following about RAM user authentication:

During logon, users must still enter a password or use public key authentication. If multi-factor authentication (MFA) is enabled, users must also enter a verification code.
Password-free logon depends on the password or private key configured for the host account, not on the RAM identity itself.

Why can't the browser start and shows a prompt that USMdriver needs to be reconfigured?

This issue occurs because only the deployment script was run, but the USMdriver component was not properly published as part of the application publishing process. To resolve the issue, refer to Add and deploy an application server to reconfigure the application publishing workflow and ensure that USMdriver is correctly published.

Does Bastionhost support logging into HTTP services?

Bastionhost does not directly provide the ability to log into HTTP services. The core capability of Bastionhost is remote O&M for Windows and Linux servers. If you need to access an HTTP service, configure a web application with a browser-based remote client (Google Chrome or Mozilla Firefox), enter the HTTP service URL as the Destination URL, and then access the service through the application during O&M sessions.