> ## Documentation Index > Fetch the complete documentation index at: https://docs.neoagent.io/llms.txt > Use this file to discover all available pages before exploring further. # Connecting Parallels RAS to Neo > Publish a client's RAS REST API and save a RAS administrator for Neo ## Before you start * Neo uses the Parallels RAS REST API, which the RAS Web Administration Service serves at `https://:20443/api/` unless you changed its port. * Neo reaches the farm over the internet. The REST API must answer on **HTTPS** with a certificate from a public certificate authority, at a public address. RAS's own certificate is self-signed, so Neo refuses it: put a reverse proxy with a public certificate in front of the API, or give the Web Administration Service a public certificate. * Neo connects to each client's farm on its own. Add the client to your **Companies** tab first. ### If the RAS server is only on the client's internal network Most are. This guide publishes only the REST API, never the RAS Console or the user portal, through a reverse proxy at the client's network edge that: * answers on a public name over HTTPS, with a certificate from a public certificate authority; * forwards only paths under `/api/` to the RAS server, and refuses every other path; * accepts connections only from [Neo's addresses](https://docs.neoagent.io/integrations/ip-whitelisting.md); * passes the `auth_token` header through. Save the proxy's public address in Neo. ## 1. Make a RAS administrator for Neo **1. Create the user** Create a domain user for Neo, such as `ACME\neo-ras`, with a strong password that does not expire without notice. **2. Make it a RAS administrator** In the RAS Console, open **Administration** > **Accounts**, add Neo's user, and give it the permissions your agents need: a power administrator with view rights for an agent that only reads; the right to manage sessions, RD Session Hosts and publishing for the drain, session and publishing jobs; a root administrator only when Neo should also change farm settings. Neo can do only what this administrator may do, whatever the agent's access profile says. > [!WARNING] > > If the password expires or you lock the user, Neo loses access to that client's farm until you save the new password here. ## 2. Add the connection in Neo **1. Open Integrations** In the Neo Dashboard, open [**Integrations** → **Parallels RAS**](https://dashboard.neoagent.io/integrations?open=parallels_ras), under Servers & Virtualization. **2. Pick the client** In **Customer**, choose the client this farm belongs to. The client must be on your **Companies** tab. For a second client, click **Add customer**. **3. Save the address, user name and password** Enter the **Server URL** with its port (for example `https://ras.example.com:20443`, or the proxy's address), Neo's **User name** (such as `ACME\neo-ras`) and its **Password**, then click **Save settings**. Neo signs in and out again before saving, so a wrong address or a refused password is rejected straight away, with what to fix. ## 3. Turn Parallels RAS on per agent Open the agent, go to the Integrations section, and configure the Parallels RAS block. Agents see only what Neo's RAS administrator can see. ### Pick an access profile > **Read Only** > > Read farm health, hosts, sessions, published resources and licence use. Nothing is changed. > **Helpdesk** > > Host, session and publishing changes (drain a host, log off a session, publish or unpublish an application) wait on a technician. Everything else is read only. > **IT Admin** > > Host, session, publishing and client policy changes run without approval, except the changes that always ask. Farm server, settings and administrator changes wait on a technician. > **Full Automation** > > Every change runs without approval, except the [changes that always ask a technician](#changes-that-always-ask-a-technician). To publish and unpublish applications only after a technician approves, use Helpdesk, or set **Published Resources** to Read/Write with technician approval. ### Or set each area by hand | Area | Notes | | - | - | | **Session Hosts & Pools** | RD Session Hosts, host pools, templates, VDI and AVD hosts, providers and their virtual machines: drain mode, logons, enable or disable, reboot and shutdown. | | **User Sessions** | User sessions on RD Session Hosts, VDI and AVD, their processes, and which published resources each user runs: message, disconnect, log off, end a process. | | **Published Resources** | Published applications, desktops, documents and folders, who sees them, their icons, and portal themes. | | **Client Policies & Connection** | Client policies, logon hours, connection, printing, scanning and URL redirection settings, allowed devices. | | **Farm, Sites & Servers** | Sites, Connection Brokers, Secure Gateways, HALB, Enrollment Servers, RAS agents, certificates, notifications, licence, tenants and farm settings. | | **Administrators & Authentication** | RAS administrators and their sessions, multi-factor authentication, SAML, Active Directory integration and connection authentication. Every change here waits on a technician. | Each area can be Disabled, Read Only or Read/Write, and has its own technician approval setting. ### Changes that always ask a technician These wait on a technician under every profile, whatever the area's own approval setting: * Deleting a site, a Connection Broker, a Secure Gateway, an Enrollment Server, a HALB, a provider, an RD Session Host, a host pool, a template, an AVD workspace, a VDI host, a tenant, a certificate or a RAS agent. * A reboot, shutdown, stop, reset or restart, and recreating a host pool's hosts or a template's desktops. * Creating a reboot, shutdown or disable schedule, changing any schedule, adding a host to one, and changing the auto-upgrade settings, which drain hosts and can log off their sessions. * Activating or deactivating the RAS licence, and promoting a site or a Connection Broker. * Sending a support request or a system report to Parallels. * Joining or leaving a tenant broker, and making a new tenant join hash or invitation. * Changing the Web Administration Service settings, which serve the REST API Neo calls. * Any change to administrators, administrator sessions, multi-factor authentication or authentication. * Any change that stores a credential: a password, a secret key, a licence key or a join hash. ## Troubleshooting | Error when you save | What to check | | - | - | | No Parallels RAS REST API answered | The address and port: it must be the server that runs the RAS Web Administration Service, or your proxy in front of it. | | Parallels RAS rejected the user name or password | The user name (`DOMAIN\user` or `user@domain`) and password, and that the user is a RAS administrator. | | Did not show a certificate from a public authority | Put a reverse proxy with a public certificate in front of the API, or give the Web Administration Service one. | | Could not reach Parallels RAS | The address, that it is public, and that Neo's addresses can reach it. | This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.