{"id":21200,"date":"2019-05-27T06:17:23","date_gmt":"2019-05-27T05:17:23","guid":{"rendered":"https:\/\/developer.kore.ai\/v10-1\/?p=21200"},"modified":"2024-02-09T06:55:14","modified_gmt":"2024-02-09T06:55:14","slug":"using-single-sign-on","status":"publish","type":"post","link":"https:\/\/developer.kore.ai\/v10-1\/docs\/bots\/bot-admin\/security-control\/using-single-sign-on\/","title":{"rendered":"Using Single Sign-On"},"content":{"rendered":"<section class=\"l-section wpb_row height_auto\"><div class=\"l-section-h i-cf\"><div class=\"g-cols vc_row type_default valign_top\"><div class=\"vc_col-sm-12 wpb_column vc_column_container\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\r\n\t<div class=\"wpb_text_column \">\r\n\t\t<div class=\"wpb_wrapper\">\r\n\t\t\t<p>On the Kore.ai <strong>Single Sign-On<\/strong>\u00a0page, in the <strong>Security &amp; Control<\/strong> module of the Bots\u00a0Admin Console, you can configure Single Sign-On (SSO)<span class=\"MCExpanding expanding MCExpanding_Closed\" data-mc-state=\"closed\">\u00a0<\/span>authentication for your Kore.ai managed users\u00a0using the following:<\/p>\n<ul>\n<li>OpenID Connect<\/li>\n<li>Security Assertion Markup Language (SAML)<\/li>\n<li>WS-Federation\u00a0sign-on protocol.<\/li>\n<\/ul>\n<p>SSO enables easy access to the Kore.ai application using your existing identity provider. With SSO, your users can log on once, for example, to your company account, and when accessing their Kore.ai application, the same login credentials can be used automatically by the system.<\/p>\n<p>For example, using the <em class=\"TitleOrPath_Kore.ai\">WS-Federation<\/em> sign-on protocol, you can enable a user to sign on to the Kore.ai application using Microsoft<sup>\u00ae<\/sup> Active Directory<sup>\u00ae<\/sup> server credentials.<\/p>\n<p>The following illustration shows the <strong>Single Sign-On<\/strong> page in the Bots\u00a0Admin Console\u00a0<strong>Security &amp; Control<\/strong> module.<\/p>\n<p><a ref=\"magnificPopup\" href=\"\/wp-content\/uploads\/sites\/35\/BAC_sso.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-22080\" src=\"\/wp-content\/uploads\/sites\/35\/BAC_sso.png\" alt=\"\" width=\"1366\" height=\"768\" srcset=\"https:\/\/kore-wordpress.s3.us-east-2.amazonaws.com\/developer.kore.ai\/v10-1\/wp-content\/uploads\/sites\/35\/20221201094248\/BAC_sso.png 1366w, https:\/\/kore-wordpress.s3.us-east-2.amazonaws.com\/developer.kore.ai\/v10-1\/wp-content\/uploads\/sites\/35\/20221201094248\/BAC_sso-300x169.png 300w, https:\/\/kore-wordpress.s3.us-east-2.amazonaws.com\/developer.kore.ai\/v10-1\/wp-content\/uploads\/sites\/35\/20221201094248\/BAC_sso-1024x576.png 1024w\" sizes=\"auto, (max-width: 1366px) 100vw, 1366px\" \/><\/a><\/p>\n\r\n\t\t<\/div>\r\n\t<\/div>\r\n<div class=\"w-separator size_small with_line width_default thick_1 style_solid color_border align_center\"><div class=\"w-separator-h\"><\/div><\/div>\r\n\t<div class=\"wpb_text_column \">\r\n\t\t<div class=\"wpb_wrapper\">\r\n\t\t\t<h2><span class=\"ez-toc-section\" id=\"Enable_or_Disable_SSO\">Enable or Disable SSO<\/span><\/h2>\n<p>Depending on the security required for your company, you can enable or disable Single Sign-On (SSO) for users accessing the Kore.ai application.<\/p>\n<p>When you disable SSO or when the SSO authentication validity period expires, users must create and log on using their credentials. If no account specific password policies have been defined, then default Kore.ai password policies are automatically enabled for the users.<\/p>\n<p class=\"Howto_Kore.ai\"><strong>To enable Single Sign-On<\/strong><\/p>\n<ul>\n<li value=\"1\">In the <strong class=\"UserInterface_Kore.ai\">Security &amp; Control<\/strong>\u00a0module, on the <strong class=\"UserInterface_Kore.ai\">Single Sign On<\/strong> page, click <strong class=\"UserInterface_Kore.ai\">Enable SSO<\/strong>.<a ref=\"magnificPopup\" href=\"\/wp-content\/uploads\/sites\/35\/Enable_SSO.png\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-7896 size-full alignnone\" src=\"\/wp-content\/uploads\/sites\/35\/Enable_SSO.png\" alt=\"Enable SSO\" width=\"1342\" height=\"460\" \/><\/a><\/li>\n<\/ul>\n<p class=\"Howto_Kore.ai\"><strong>To disable Single Sign-On<\/strong><\/p>\n<ul>\n<li value=\"1\">In the <strong class=\"UserInterface_Kore.ai\">Security &amp; Control<\/strong> module, on the <strong class=\"UserInterface_Kore.ai\">Single Sign On<\/strong> page, click <strong class=\"UserInterface_Kore.ai\">Disable SSO<\/strong>, and then configure user password policies.<a ref=\"magnificPopup\" href=\"\/wp-content\/uploads\/sites\/35\/Disable_SSO.png\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-7897 size-full alignnone\" src=\"\/wp-content\/uploads\/sites\/35\/Disable_SSO.png\" alt=\"Disable SSO\" width=\"1072\" height=\"328\" \/><\/a><\/li>\n<\/ul>\n\r\n\t\t<\/div>\r\n\t<\/div>\r\n<div class=\"w-separator size_small with_line width_default thick_1 style_solid color_border align_center\"><div class=\"w-separator-h\"><\/div><\/div>\r\n\t<div class=\"wpb_text_column \">\r\n\t\t<div class=\"wpb_wrapper\">\r\n\t\t\t<h2><span class=\"ez-toc-section\" id=\"OpenID_Connect\">OpenID Connect<\/span><\/h2>\n<p>Complete the steps in the following procedure to configure SSO using Open ID Connect protocol in the <strong>Security &amp; Control<\/strong> module of the Bots Admin Console. Kore.ai also supports WS-Federation and SAML Connect protocols.<\/p>\n<ol>\n<li>In the <strong class=\"UserInterface_Kore.ai\">Security &amp; Control<\/strong> module on the <strong class=\"UserInterface_Kore.ai\">Single Sign On<\/strong> page in the Bots\u00a0Admin Console, click <strong class=\"UserInterface_Kore.ai\">Enable SSO<\/strong>.<\/li>\n<li>In the <strong class=\"UserInterface_Kore.ai\">Select suitable Sign-On Protocol<\/strong> section, select <strong class=\"UserInterface_Kore.ai\">OpenID Connect<\/strong>.<\/li>\n<li>In the <strong class=\"UserInterface_Kore.ai\">Configure SSO for OpenID Connect<\/strong> section, select an identity provider, for example, <strong class=\"UserInterface_Kore.ai\">Sign in with Google<\/strong>.<\/li>\n<li>Click <strong class=\"UserInterface_Kore.ai\">Save<\/strong>.<\/li>\n<li>The <em class=\"TitleOrPath_Kore.ai\">Identity Provider information successfully updated<\/em> message is displayed at the top of the page.<\/li>\n<\/ol>\n\r\n\t\t<\/div>\r\n\t<\/div>\r\n<div class=\"w-separator size_small with_line width_default thick_1 style_solid color_border align_center\"><div class=\"w-separator-h\"><\/div><\/div>\r\n\t<div class=\"wpb_text_column \">\r\n\t\t<div class=\"wpb_wrapper\">\r\n\t\t\t<h2><span class=\"ez-toc-section\" id=\"WS-Federation\">WS-Federation<\/span><\/h2>\n<p>Complete the steps in the following procedure to configure Single Sign-On (SSO) using the WS-Federation protocol in the <strong>Security &amp; Control<\/strong> module of the Bots Admin Console.<\/p>\n<ol>\n<li>In the <strong>Security &amp; Control<\/strong> module on the <strong>Single Sign On<\/strong> page in the Bots\u00a0Admin Console, click <strong>Enable SSO<\/strong>.<\/li>\n<li>In the <strong>Select suitable Sign-On Protocol<\/strong> section, select <strong>WS-Federation<\/strong>.<\/li>\n<li>In the <strong>Configure SSO for WS-Federation<\/strong> section, select an identity provider, and then define the settings for:\n<ul>\n<li><strong>Windows Azure<sup>\u00ae<\/sup><\/strong>\n<ul>\n<li><strong>Azure AD Sign-On End Point URL<\/strong> &#8211; The URL that Kore.ai sends sign on and sign off requests using <em>Azure<\/em>. The response for the authentication is sent to the <strong>Reply URL<\/strong> defined in your <em>Azure<\/em> Active Directory configuration settings.<\/li>\n<li><strong>Azure AD Federation Metadata Document<\/strong> &#8211; The URL for the federation metadata document used for authentication with <em>Azure<\/em> Active Directory.<\/li>\n<\/ul>\n<\/li>\n<li><strong>Other<\/strong> &#8211; Generic WS-Federation identity provider configuration, other than Azure\n<ul>\n<li><strong>AD Sign-On End Point URL<\/strong> &#8211; The URL that Kore.ai sends sign on and sign off requests using your WS-Federation identity provider.<\/li>\n<li><strong>AD Federation Metadata Document URL<\/strong> &#8211; The URL for the WS-Federation metadata document used for authentication with Active Directory.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<li>\n<p class=\"p1\"><span class=\"s1\">In the administrative console for your Single Sign-On provider, you will also need to define the URLs that are used to exchange data between Kore.ai and your SSO provider. While\u00a0<\/span>the URL names may vary by SSO provider, you will need to define these URLs:<\/p>\n<ul>\n<li><strong>SAML 2.0<\/strong>\n<ul>\n<li><strong>LDAP Attribute:<\/strong> nameId<\/li>\n<li><strong>Claim Attribute:<\/strong> uri<\/li>\n<\/ul>\n<\/li>\n<li><strong>SAML 1.1<\/strong>\n<ul>\n<li><strong>LDAP Attribute:<\/strong> nameId<\/li>\n<li><strong>Claim Attribute:<\/strong> emailAddress<\/li>\n<\/ul>\n<\/li>\n<li><strong>Assertion Consumer Service (ACS) URL<\/strong> or <strong>Callback URL<\/strong> as <a href=\"https:\/\/idp.kore.com\/authorize\/callback\"><span style=\"color: #0000ff;\">https:\/\/idp.kore.com\/authorize\/callback<\/span><\/a>.<\/li>\n<li>In addition to authentication values, you must pass the email address of the user as an LDAP attribute from Active Directory when using ADFS. For more information, <a href=\"#attributes-adfs\">see Attributes for ADFS<\/a>.<\/li>\n<li>Click <strong>Save<\/strong>.<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n<p>The <em class=\"TitleOrPath_Kore.ai\">Identity Provider information successfully updated<\/em> message is displayed at the top of the page.<\/p>\n\r\n\t\t<\/div>\r\n\t<\/div>\r\n<div class=\"w-separator size_small with_line width_default thick_1 style_solid color_border align_center\"><div class=\"w-separator-h\"><\/div><\/div>\r\n\t<div class=\"wpb_text_column \">\r\n\t\t<div class=\"wpb_wrapper\">\r\n\t\t\t<h2><span class=\"ez-toc-section\" id=\"SAML\">SAML<\/span><\/h2>\n<p>Security Assertion Markup Language (SAML) is a standard protocol for web browser Single Sign-On (SSO) using secure tokens. SAML completely eliminates all passwords and instead uses standard cryptography and digital signatures to pass a secure sign-in token from an identity provider to a SaaS application.<\/p>\n<p>SAML provides a solution to allow your identity provider and service providers to exist separately from each other. When a user logs into a SAML-enabled application, the service provider requests authorization from the appropriate identity provider. The identity provider authenticates the user\u2019s credentials and then returns the authorization for the user to the service provider, and the user is now able to use the application.<\/p>\n<h4>How SAML works<\/h4>\n<p>SAML SSO works by transferring the user\u2019s identity from one place (the identity provider) to another (the service provider). This is done through an exchange of digitally signed XML documents.<\/p>\n<p>Consider the following scenario: A user is logged into a system that acts as an identity provider. The user wants to log in to a remote application, such as a support or accounting application (the service provider). The following happens:<\/p>\n<ol>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">The user accesses the remote application using a link on an intranet, a bookmark, or similar and the application loads.<\/span><\/li>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">The application identifies the user\u2019s origin (by application subdomain, user IP address, or similar) and redirects the user back to the identity provider, asking for authentication. This is the authentication request.<\/span><\/li>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">The user either has an existing active browser session with the identity provider or establishes one by logging into the identity provider.<\/span><\/li>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">The identity provider builds the authentication response in the form of an XML-document containing the user\u2019s username or email address, signs it using an X.509 certificate, and posts this information to the service provider.<\/span><\/li>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">The service provider, which already knows the identity provider and has a certificate fingerprint, retrieves the authentication response and validates it using the certificate fingerprint.<\/span><\/li>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">The identity of the user is established and the user is provided with app access.<\/span><\/li>\n<\/ol>\n<h4>Kore.ai Implementation<\/h4>\n<p>There are two ways SAML can be used within Kore.ai Bots Platform:<\/p>\n<ul>\n<li>For developer authentication to access the Bot Builder,<\/li>\n<li>For user authentication to access the Bot.<\/li>\n<\/ul>\n<h4><span style=\"font-weight: 400;\">Use case 1: Bot builder authentication. <\/span><\/h4>\n<p><span style=\"font-weight: 400;\">Enterprises can set up access to the Bot builder tool using the enterprise SSO. Bot developers and admins can log into bot builder using SSO done by the enterprise identity provider. <\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><br \/>\n<strong>SSO flow from Kore.ai Bots platform<\/strong>: The following is the flow within the Kore.ai Bots platform once SSO is configured using SAML:<\/p>\n<ol>\n<li>The client makes a call to Kore app server (using the login URL) with user details to get identity provider info\u00a0(SAML).<\/li>\n<li>Kore app server initiates a handshake request with the Kore idproxy\u00a0server.<\/li>\n<li>Kore idproxy\u00a0server initiates a request to the identity provider (SAML) with user details.<\/li>\n<li>On successful authentication, the identity provider (SAML) returns an assertion response to the Kore idproxy server.<\/li>\n<li>Upon verifying the response from the identity provider, Kore\u00a0idproxy server initiates a request to the Kore\u00a0app server.<\/li>\n<li>On successful authentication of the token from Kore idproxy server, Kore app server grants access to the user.<\/li>\n<\/ol>\n<p>Post v7.2 release, Kore.ai supports the IDP initiated flow, wherein the platform gets the postback directly with SAML response and is able to validate the assertion and register\/identify the user. The configuration for these modes &#8211; SP-based and IDP-based flow is different and is highlighted in the configuration steps below.<\/p>\n<p><span style=\"font-weight: 400;\">Refer below\u00a0<\/span><a href=\"#configure\"><span style=\"font-weight: 400;\">to configure SSO using SAML<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><\/a><\/p>\n<h4><span style=\"font-weight: 400;\">Use case 2: End-user authentication<\/span><\/h4>\n<p><span style=\"font-weight: 400;\">In this scenario, the bot chat interface is embedded on the customer portal or Mobile app that requires user authentication via SSO. \u00a0<\/span><br \/>\n<span style=\"font-weight: 400;\">The Bot access is automatically limited to authenticated users. \u00a0If the task requires API invocation that requires SSO based authentication the developer can follow the below steps<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">On the client, developer needs to retrieve SSO token of the logged in user and pass it to the bot using the <\/span><b><i>secureCustomPayload<\/i><\/b><span style=\"font-weight: 400;\"> parameter in the Bot SDK API.<\/span><\/li>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">In the dialog task, Bot developer can write custom logic to read this token and add it as API headers for secure API calls made using service node or webhook node. <\/span><\/li>\n<\/ul>\n<p><span style=\"font-weight: 400;\">The token information on the client varies depending upon the SSO provider and the payload, accordingly the developer would need to write custom logic. <\/span><\/p>\n<h4 id=\"configure\">Configuring SSO using SAML<\/h4>\n<p>Complete the following steps to configure Single Sign-On (SSO) using Security Assertion Markup Language (SAML) protocol in the Kore.ai Bots Admin Console. Kore.ai also supports WS-Federation and OpenID Connect protocols. For more information, see <a class=\"MCXref xref\" href=\"\/docs\/bots\/adminconsole\/security\/using-single-sign-on\/\">Using Single Sign-On<\/a>.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"OKTA_Configuration\">OKTA Configuration<\/span><\/h3>\n<ol>\n<li>In the <strong class=\"UserInterface_Kore.ai\">Security &amp; Control<\/strong>\u00a0module on the <strong class=\"UserInterface_Kore.ai\">Single Sign On<\/strong> page in the Bots\u00a0Admin Console, click <strong class=\"UserInterface_Kore.ai\">Enable SSO<\/strong>.<\/li>\n<li>In the <strong class=\"UserInterface_Kore.ai\">Select a suitable Sign-On Protocol<\/strong> section, select <strong>SAML<\/strong>.<\/li>\n<li>In the <strong>Configure SSO for SAML<\/strong> section,\u00a0select an identity provider,\u00a0and then define the settings for one of:\n<ul>\n<li><strong>Okta Single Sign-On URL<\/strong> &#8211; The SSO\u00a0URL for <em>Okta<\/em> this is to enable Service Provider initiated SAML flow.<\/li>\n<li><strong>Identity Provider Issuer<\/strong> &#8211; The entity that provides the user identities including the ability to authenticate a user.<\/li>\n<li><strong>Certificate<\/strong> &#8211; The public certificate stored by the service provider from the identity provider used to validate a user signature. You can add multiple (max of 2) certificates, delete already added invalid certificates, platform will use the latest certificate for authorization, in case it is invalid then the older certificate would be used.<\/li>\n<li><strong>ACS URL for SP Initiated SAML Flow<\/strong> &#8211; This is the redirect URL for Service Provided initiated SAML flow.<\/li>\n<li><strong>ACS URL for IDP Initiated SAML Flow<\/strong> &#8211; This is the account-specific URL for Identity Provided initiated SAML flow.<\/li>\n<li><strong>SAML Attribute Mapping<\/strong> &#8211; Enable this option to map SAML Attributes with Kore.ai Group Names or Admin Roles Names. Once enabled, you can:\n<ul>\n<li>define how the SAML attributes should be mapped with Kore.ai attributes:\n<ul>\n<li>Full Sync &#8211; Every time the user signs in, the platform will update the user\u2019s Group and Role assignments based on the SAML Attributes present in the response. All existing assignments will be removed. Only the new group or role assignments as available in the SAML response will be assigned<\/li>\n<li>Inclusion Only &#8211; Every time the user signs in, the platform will only assign the new group or roles available in the SAML response.\u00a0All existing assignments will be retained. New assignments will be added as available in the SAML responses<\/li>\n<\/ul>\n<\/li>\n<li>define one or more mapping pairs. Each pair includes\n<ul>\n<li>SAML Attribute Name &#8211; Name of the SAML attribute as available in the SAML response<\/li>\n<li>SAML Attribute Value &#8211; Value associated with the SAML attribute<\/li>\n<li>Attribute Type &#8211; Refers to the type of mapping to be associated i.e. Group Name or Role Name\n<ul>\n<li>Group Name &#8211; Refers to any of the user groups defined in the Kore.ai account<\/li>\n<li>Role Name &#8211; Refers to the following<\/li>\n<li>Admin Roles defined in the Kore.ai account<\/li>\n<li>Bot Builder Access<\/li>\n<li>New Bot Creation<\/li>\n<li>Manage Data Tables and Views<\/li>\n<\/ul>\n<\/li>\n<li>Kore.ai Attribute &#8211; Refers to either Group Name or Role Name. The list should include the following:\n<ul>\n<li>List of all Admin Roles<\/li>\n<li>Bot Builder Access<\/li>\n<li>New Bot Creation<\/li>\n<li>Manage Data Tables and Views<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<h4>Okta for Kore.ai SSO<\/h4>\n<p>To configure Single Sign-On in <em>Okta<\/em> for Kore.ai, you must first add the Kore.ai app to your <em>Okta<\/em>\u00a0account, and then copy URLs and the security certificate from <em>Okta<\/em>\u00a0into your Kore.ai account. This topic describes how to add the Kore.ai app to your <em>Okta<\/em>\u00a0account, and then access the URLs and certificate needed for the Kore.ai configuration for SSO using <em>Okta<\/em>.<\/p>\n<p>To complete this procedure, you must have already selected <em>Okta<\/em>\u00a0as a SAML provider on the\u00a0<strong>Single Sign On<\/strong> page\u00a0in\u00a0the Bots\u00a0Admin Console.<br \/>\n<strong>To add the Kore.ai app to\u00a0Okta<\/strong><\/p>\n<ol>\n<li>Log on to <em>Okta<\/em>.<\/li>\n<li>On the <strong>Home<\/strong> page, click <strong>Admin<\/strong>.\u00a0The <strong>Dashboard<\/strong>\u00a0page is displayed.<\/li>\n<li>On the top navigation bar, click <strong>Applications<\/strong>. The <strong>Applications<\/strong> page is displayed.<\/li>\n<li>Click <strong>Add Application<\/strong>. The <strong>Add Application<\/strong> page is displayed.<\/li>\n<li>Click <strong>Create application<\/strong><\/li>\n<li>In the <strong>General settings<\/strong>, provide an <em>App name<\/em> and click <strong>Next<\/strong>.<\/li>\n<li>In <strong>Configure SAML<\/strong>, provide the <em>Single SignOn URL.<\/em> To obtain this:\n<ul>\n<li>Login to Kore.ai Bot Builder Admin Console<\/li>\n<li>under <strong>Security &amp; Control<\/strong> -&gt; <strong>Single Sign on page <\/strong><\/li>\n<li>after enabling <strong>SAML<\/strong> and selecting <strong>Okta<\/strong><\/li>\n<li><strong>ACS URL for SP Initiated SAML Flow field<\/strong> would contain the required URL.<\/li>\n<li>For on-prem accounts, the ACS URL for SP Initiated SAML Flow is displayed as <em>https:\/\/idproxy-dev.kore.com\/authorize\/callback<\/em> . This needs to be updated as \u201csingle sign on URL\u201d in Okta platform and <em>https:\/\/idproxy-dev.kore.com<\/em> needs to be updated as the \u201cAudience URL\u201d<\/li>\n<li>You can provide the <strong>Attribute statements<\/strong>\u00a0like emailId, firstName as per your requirement.<\/li>\n<\/ul>\n<\/li>\n<li>To configure <strong>ACS URL for IDP Initiated SAML Flow<\/strong>, copy and paste the complete URL that get from your admin. In case you are using internal redirection URLs, please reach out to your internal admin\/network teams.<br \/>\nTo get the <strong>ACS URL for IDP Initiated SAML Flow <\/strong> URL, check \u201cUser this Recipient URL and Destination URL\u201d.<br \/>\nEnter the <strong>Audience URI<\/strong> field as ACS URL for SP Initiated SAML Flow (<a href=\"https:\/\/idp.kore.com\/authorize\/callback\">https:\/\/idp.kore.com\/authorize\/callback<\/a>).<br \/>\n<b>Note<\/b>: This URL is a temporary URL. Once you add the Kore.ai app in Okta, this URL changes as per your organizations domain requirements. You must copy the final ACS URL again and paste in the field. For more information, read <a href=\"https:\/\/community.kore.ai\/t\/sso-how-to-configure-okta-sso-in-kore-ai-xo-platform\/2618\" target=\"new window\" rel=\"noopener noreferrer\">How to configure Okta SSO in Kore.ai XO Platform <\/a> community post.<\/li>\n<li>Click <strong>Finish<\/strong>.<\/li>\n<\/ol>\n<\/li>\n<li>On the <strong>Sign\u00a0On<\/strong> tab, in the <strong>Settings<\/strong>\u00a0section, click <strong>View Setup Instructions<\/strong>. The <strong>How to Configure SAML 2.0 for &lt;app-name&gt; Application<\/strong> page is displayed.<\/li>\n<li>Copy the URLs in the:\n<ul>\n<li><strong>Identity Provider Single Sign-On URL<\/strong>\u00a0field to the <strong>Okta Single Sign-On URL<\/strong>\u00a0field in Kore.ai.<\/li>\n<li><strong>Identity Provider Issuer<\/strong>\u00a0field to the Kore.ai <strong>Identity provider issuer<\/strong>\u00a0field<\/li>\n<\/ul>\n<\/li>\n<li>In the Okta<strong>\u00a0X.509 Certificate<\/strong> field, copy the certificate data, and then paste the data into the Kore.ai <strong>Certificate<\/strong> text box.\n<div>\n<p class=\"note\"><strong>Note:<\/strong> Only data after the <strong>&#8212;&#8211;BEGIN CERTIFICATE&#8212;&#8211;\u00a0<\/strong>header and before\u00a0the <strong>&#8212;&#8211;END CERTIFICATE&#8212;-<\/strong> footer should be copied and pasted into Kore.ai.<\/p>\n<\/div>\n<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n<ul>\n<li>In Kore.ai, click <strong>Save<\/strong>. This will complete the integration of Okta login.<\/li>\n<\/ul>\n<p>The <em>Identity Provider information successfully updated<\/em> message is displayed at the top of the page. To test the configuration, log off the Kore.ai Bots\u00a0Admin Console, and log on again. The Okta\u00a0portal should be displayed.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"OneLogin_Configuration\">OneLogin Configuration<\/span><\/h3>\n<ul>\n<li><strong>OneLogin<\/strong> &#8211;\u00a0For more information, refer below, or in the <em>OneLogin<\/em>\u00a0documentation, see\u00a0<a href=\"https:\/\/www.onelogin.com\/connector\/kore\">Configuring SSO for Kore.ai<\/a>.\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li><strong>SAML 2.0 Endpoint<\/strong> &#8211; The HTTP SSO endpoint for <em>OneLogin <\/em>to enable Service Provider initiated SAML flow, for example, https:\/\/app.onelogin.com\/trust\/saml2\/http-post\/sso\/358111.<\/li>\n<li><strong>Issuer URL<\/strong> &#8211; The URL for the <em>OneLogin<\/em> issuer, for example,<span class=\"wysiwyg-color-blue\">https:\/\/app.onelogin.com\/saml\/metadata\/358111<\/span>.<\/li>\n<li><strong>X.509 Certificate<\/strong> &#8211; The public certificate stored by the service provider from the identity provider used to validate a user signature. You can add multiple (max of 2) certificates, delete already added invalid certificates, platform will use the latest certificate for authorization, in case it is invalid then the older certificate would be used.<\/li>\n<li><strong>ACS URL for SP Initiated SAML Flow<\/strong> &#8211; This is the redirect URL for Service Provided initiated SAML flow.<\/li>\n<li><strong>ACS URL for IDP Initiated SAML Flow<\/strong> &#8211; This is the account-specific URL for Identity Provided initiated SAML flow.<\/li>\n<li><strong>SAML Attribute Mapping<\/strong> &#8211; Enable this option to map SAML Attributes with Kore.ai Group Names or Admin Roles Names. Once enabled, you can:\n<ul>\n<li>define how the SAML attributes should be mapped with Kore.ai attributes:\n<ul>\n<li>Full Sync &#8211; Every time the user signs in, the platform will update the user\u2019s Group and Role assignments based on the SAML Attributes present in the response. All existing assignments will be removed. Only the new group or role assignments as available in the SAML response will be assigned<\/li>\n<li>Inclusion Only &#8211; Every time the user signs in, the platform will only assign the new group or roles available in the SAML response.\u00a0All existing assignments will be retained. New assignments will be added as available in the SAML responses<\/li>\n<\/ul>\n<\/li>\n<li>define one or more mapping pairs. Each pair includes\n<ul>\n<li>SAML Attribute Name &#8211; Name of the SAML attribute as available in the SAML response<\/li>\n<li>SAML Attribute Value &#8211; Value associated with the SAML attribute<\/li>\n<li>Attribute Type &#8211; Refers to the type of mapping to be associated i.e. Group Name or Role Name\n<ul>\n<li>Group Name &#8211; Refers to any of the user groups defined in the Kore.ai account<\/li>\n<li>Role Name &#8211; Refers to the following<\/li>\n<li>Admin Roles defined in the Kore.ai account<\/li>\n<li>Bot Builder Access<\/li>\n<li>New Bot Creation<\/li>\n<li>Manage Data Tables and Views<\/li>\n<\/ul>\n<\/li>\n<li>Kore.ai Attribute &#8211; Refers to either Group Name or Role Name. The list should include the following:\n<ul>\n<li>List of all Admin Roles<\/li>\n<li>Bot Builder Access<\/li>\n<li>New Bot Creation<\/li>\n<li>Manage Data Tables and Views<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<h4 id=\"onelogin\">OneLogin for Kore.ai SSO<\/h4>\n<p>To configure Single Sign-On in Kore.ai using <em>OneLogin<\/em>, you must first add the Kore.ai app to your\u00a0<em>OneLogin<\/em> account, and then copy URLs and the security certificate from <em>OneLogin<\/em> into your Kore.ai account. This topic describes how to add the Kore.ai app to your <em>OneLogin<\/em> account, and then access the URLs and certificate needed for the Kore.ai configuration for SSO using <em>OneLogin<\/em>.<br \/>\nTo complete this procedure, you must have already selected <em>OneLogin<\/em> as a SAML provider on the <strong>Single Sign On<\/strong> page\u00a0in\u00a0the Bots\u00a0Admin Console.<br \/>\n<strong>To add the Kore.ai app to OneLogin<\/strong><\/p>\n<ol>\n<li>Log on to <em>OneLogin<\/em>.<\/li>\n<li>On the <strong>APPS<\/strong> menu, click <strong>Add Apps<\/strong>. The <strong>Find Applications<\/strong> page is displayed.<\/li>\n<li>In the <strong>Search<\/strong> field, enter <span class=\"wysiwyg-color-blue\">Kore.ai<\/span>, and then press <strong>Enter<\/strong>. The Kore.ai app for <em>OneLogin<\/em> is displayed.<\/li>\n<li>Click the Kore.ai app. The <strong>Add Kore.ai<\/strong> page is displayed.<\/li>\n<li>Optionally, change the display name or the icons displayed\u00a0to your users in the <em>OneLogin\u00a0<\/em>portal, and then click <strong>SAVE<\/strong>. The Kore.ai app is added to your Company apps for <em>OneLogin\u00a0<\/em>and the Kore.ai app page is displayed.<\/li>\n<li>On the <strong>SSO<\/strong> tab, in the <strong>Enable SAML2.0<\/strong> section, copy the URLs in the:\n<ul>\n<li><strong>OneLogin SAML 2.0 Endpoint (HTTP)<\/strong> field to the Kore.ai\u00a0<strong>SAML 2.0 Endpoint\u00a0<\/strong>field<\/li>\n<li><strong>OneLogin Issuer URL<\/strong> field to the Kore.ai <strong>Issuer URL<\/strong> field<\/li>\n<\/ul>\n<\/li>\n<li>In the <strong>OneLogin X.509 Certificate<\/strong> field, click <span class=\"wysiwyg-color-blue\">View Details<\/span>. The\u00a0<strong>Standard Strength Certificate (2048-bit)<\/strong> page is displayed.<\/li>\n<li>In the <strong>X.509 Certificate<\/strong> section, copy the certificate data, and then paste the data into the Kore.ai <strong>X.509 Certificate<\/strong> text box.\n<p class=\"note\"><strong>Note:<\/strong> Only data after the <strong>&#8212;&#8211;BEGIN CERTIFICATE&#8212;&#8211;<\/strong>header and before\u00a0the <strong>&#8212;&#8211;END CERTIFICATE&#8212;-<\/strong> footer should be copied and pasted into Kore.ai.<\/p>\n<\/li>\n<li>In Kore.ai, click <strong>Save<\/strong>.<\/li>\n<\/ol>\n<p>The <em>Identity Provider information successfully updated<\/em> message is displayed at the top of the page. To test the configuration, log off the Kore.ai Bots\u00a0Admin Console, and log on again. The <strong>OneLogin<\/strong> portal should be displayed.<br \/>\n<a ref=\"magnificPopup\" href=\"\/wp-content\/uploads\/sites\/35\/SSOOneLogin.png\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-7888 size-full alignnone\" src=\"\/wp-content\/uploads\/sites\/35\/SSOOneLogin.png\" alt=\"OneLogin Single Sign-On\" width=\"2648\" height=\"1188\" \/><\/a><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<h3><span class=\"ez-toc-section\" id=\"Bitium_Configuration\">Bitium Configuration<\/span><\/h3>\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li><strong>Single Sign-On URL<\/strong>\u00a0&#8211; The HTTP SSO endpoint for <em>Bitium <\/em>to enable Service Provider intiated SAML flow, for example, <span class=\"wysiwyg-color-blue\">https:\/\/www.bitium.com\/7655.<\/span><\/li>\n<li><strong>Issuer URL<\/strong> &#8211; The URL for the <em>OneLogin<\/em> issuer, for example,<span class=\"wysiwyg-color-blue\">https:\/\/bitium.com\/7655\/saml\/82456\/metadata.xml<\/span>.<\/li>\n<li><strong>Certificate<\/strong> &#8211; The public certificate stored by the service provider from the identity provider used to validate a user signature. You can add multiple (max of 2) certificates, delete already added invalid certificates, platform will use the latest certificate for authorization, in case it is invalid then the older certificate would be used.<\/li>\n<li><strong>ACS URL for SP Initiated SAML Flow<\/strong> &#8211; This is the redirect URL for Service Provided initiated SAML flow.<\/li>\n<li><strong>ACS URL for IDP Initiated SAML Flow<\/strong> &#8211; This is the account-specific URL for Identity Provided initiated SAML flow.<\/li>\n<li><strong>SAML Attribute Mapping<\/strong> &#8211; Enable this option to map SAML Attributes with Kore.ai Group Names or Admin Roles Names. Once enabled, you can:\n<ul>\n<li>define how the SAML attributes should be mapped with Kore.ai attributes:\n<ul>\n<li>Full Sync &#8211; Every time the user signs in, the platform will update the user\u2019s Group and Role assignments based on the SAML Attributes present in the response. All existing assignments will be removed. Only the new group or role assignments as available in the SAML response will be assigned<\/li>\n<li>Inclusion Only &#8211; Every time the user signs in, the platform will only assign the new group or roles available in the SAML response.\u00a0All existing assignments will be retained. New assignments will be added as available in the SAML responses<\/li>\n<\/ul>\n<\/li>\n<li>define one or more mapping pairs. Each pair includes\n<ul>\n<li>SAML Attribute Name &#8211; Name of the SAML attribute as available in the SAML response<\/li>\n<li>SAML Attribute Value &#8211; Value associated with the SAML attribute<\/li>\n<li>Attribute Type &#8211; Refers to the type of mapping to be associated i.e. Group Name or Role Name\n<ul>\n<li>Group Name &#8211; Refers to any of the user groups defined in the Kore.ai account<\/li>\n<li>Role Name &#8211; Refers to the following<\/li>\n<li>Admin Roles defined in the Kore.ai account<\/li>\n<li>Bot Builder Access<\/li>\n<li>New Bot Creation<\/li>\n<li>Manage Data Tables and Views<\/li>\n<\/ul>\n<\/li>\n<li>Kore.ai Attribute &#8211; Refers to either Group Name or Role Name. The list should include the following:\n<ul>\n<li>List of all Admin Roles<\/li>\n<li>Bot Builder Access<\/li>\n<li>New Bot Creation<\/li>\n<li>Manage Data Tables and Views<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<h5 id=\"bitium\">Kore.ai SSO for Bitium<\/h5>\n<p>To configure Single Sign-On in <em>Bitium<\/em> for Kore.ai, you must first add the Kore.ai app to your <em>Bitium\u00a0<\/em>account, and then copy URLs and the security certificate from <em>Bitium<\/em> into your Kore.ai account. This topic describes how to add the Kore.ai app to your <em>Bitium<\/em> account, and then access the URLs and certificate needed for the Kore.ai configuration for SSO using <em>Bitium<\/em>.<br \/>\nTo complete this procedure, you must have already selected <em>Bitium<\/em> as a SAML provider on the\u00a0<strong>Single Sign On<\/strong> page\u00a0in\u00a0the Bots\u00a0Admin Console.<br \/>\n<strong>To add the Kore.ai app to Bitium<\/strong><\/p>\n<ol>\n<li>Log on to <em>Bitium<\/em>.<\/li>\n<li>On the <strong>Manage &lt; <em>Company Name<\/em> &gt;<\/strong>\u00a0menu,\u00a0click <strong>Manage Apps<\/strong>, then click <strong>Add an App<\/strong>. The <strong>Add Apps<\/strong>\u00a0dialog is displayed.<\/li>\n<li>In the <strong>Search<\/strong> field, enter <span class=\"wysiwyg-color-blue\" style=\"color: #0000ff;\">Kore.ai<\/span>, and then press <strong>Enter<\/strong>. The <strong>Install Kore.ai app for <em>Bitium<\/em><\/strong>\u00a0 dialog is displayed.<\/li>\n<li>On the <strong>Manage Organization<\/strong> menu, click <strong>Manage Apps<\/strong>, and then click <strong>Kore.ai<\/strong>.<\/li>\n<li>On the <strong>Single Sign-On<\/strong> tab, in the <strong>Select a Single Sign-On Provider<\/strong> section, select\u00a0<strong>SAML Authentication<\/strong>.<\/li>\n<li>Copy the following URLs from <em>Bitium<\/em> into the Bots\u00a0Admin Console <em>Bitium<\/em> configuration section:\n<ul>\n<li><strong>Bitium Login URL<\/strong>\u00a0field to the Kore.ai\u00a0<strong>Single Sign-On<\/strong>\u00a0field<\/li>\n<li><strong>Bitium Logout URL<\/strong>\u00a0field to the Kore.ai <strong>Issuer URL<\/strong> field<\/li>\n<\/ul>\n<\/li>\n<li>In the Bitium\u00a0<strong>X.509 Certificate<\/strong> field, copy the certificate data, and then paste the data into the Bots\u00a0Admin Console\u00a0<strong>Certificate<\/strong> text box.\n<p class=\"note\"><strong>Note:<\/strong> Only data after the <strong>&#8212;&#8211;BEGIN CERTIFICATE&#8212;&#8211;\u00a0<\/strong>header and before\u00a0the <strong>&#8212;&#8211;END CERTIFICATE&#8212;-<\/strong> footer should be copied and pasted into Kore.ai.<\/p>\n<\/li>\n<li>In Kore.ai, click <strong>Save<\/strong>.<\/li>\n<\/ol>\n<p>The <em>Identity Provider information successfully updated<\/em> message is displayed at the top of the page. To test the configuration, log off the Kore.ai Bots\u00a0Admin Console, and log on again. The Bitium portal should be displayed.<br \/>\n<a ref=\"magnificPopup\" href=\"\/wp-content\/uploads\/sites\/35\/BitiumSSO.png\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-7892 size-full alignnone\" src=\"\/wp-content\/uploads\/sites\/35\/BitiumSSO.png\" alt=\"Bitium Single Sign-On\" width=\"443\" height=\"808\" \/><\/a><\/li>\n<li><strong>Other<\/strong> &#8211; Generic SAML\u00a0identity provider configuration. Select this option if you are not using a Kore.ai built-in configuration.\n<ul>\n<li><strong>Single\u00a0Sign-On URL<\/strong> &#8211; The URL that Kore.ai sends sign on and sign off requests using your WS-Federation identity provider. This is to enable Service Provider initiated SAML flow.<\/li>\n<li><strong>Issuer\u00a0URL<\/strong> &#8211; The URL for the WS-Federation metadata document used for authentication with Active Directory.<\/li>\n<li><strong>Certificate<\/strong> &#8211; The public certificate stored by the service provider from the identity provider used to validate a user signature. You can add multiple (max of 2) certificates, delete already added invalid certificates, platform will use the latest certificate for authorization, in case it is invalid then the older certificate would be used.<\/li>\n<li><strong>ACS URL for SP Initiated SAML Flow<\/strong> &#8211; This is the redirect URL for Service Provided initiated SAML flow.<\/li>\n<li><strong>ACS URL for IDP Initiated SAML Flow<\/strong> &#8211; This is the account-specific URL for Identity Provided initiated SAML flow.<\/li>\n<li><strong>SAML Attribute Mapping<\/strong> &#8211; Enable this option to map SAML Attributes with Kore.ai Group Names or Admin Roles Names. Once enabled, you can:\n<ul>\n<li>define how the SAML attributes should be mapped with Kore.ai attributes:\n<ul>\n<li>Full Sync &#8211; Every time the user signs in, the platform will update the user\u2019s Group and Role assignments based on the SAML Attributes present in the response. All existing assignments will be removed. Only the new group or role assignments as available in the SAML response will be assigned<\/li>\n<li>Inclusion Only &#8211; Every time the user signs in, the platform will only assign the new group or roles available in the SAML response.\u00a0All existing assignments will be retained. New assignments will be added as available in the SAML responses<\/li>\n<\/ul>\n<\/li>\n<li>define one or more mapping pairs. Each pair includes\n<ul>\n<li>SAML Attribute Name &#8211; Name of the SAML attribute as available in the SAML response<\/li>\n<li>SAML Attribute Value &#8211; Value associated with the SAML attribute<\/li>\n<li>Attribute Type &#8211; Refers to the type of mapping to be associated i.e. Group Name or Role Name\n<ul>\n<li>Group Name &#8211; Refers to any of the user groups defined in the Kore.ai account<\/li>\n<li>Role Name &#8211; Refers to the following<\/li>\n<li>Admin Roles defined in the Kore.ai account<\/li>\n<li>Bot Builder Access<\/li>\n<li>New Bot Creation<\/li>\n<li>Manage Data Tables and Views<\/li>\n<\/ul>\n<\/li>\n<li>Kore.ai Attribute &#8211; Refers to either Group Name or Role Name. The list should include the following:\n<ul>\n<li>List of all Admin Roles<\/li>\n<li>Bot Builder Access<\/li>\n<li>New Bot Creation<\/li>\n<li>Manage Data Tables and Views<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<li><span class=\"s1\">In the administrative console for your Single Sign-On provider, you will also need to define the URLs that are used to exchange data between Kore.ai and your SSO provider. While\u00a0<\/span>the URL names may vary by SSO provider, you will need to define these URLs:\n<ul>\n<li><strong>Assertion Consumer Service (ACS) URL<\/strong> or <strong>Callback URL<\/strong> as <a href=\"https:\/\/idp.kore.com\/authorize\/callback\"><span style=\"color: #0000ff;\">https:\/\/idp.kore.com\/authorize\/callback<\/span>.<\/a><\/li>\n<li>In addition to authentication values, you must pass the email address of the user as an LDAP attribute from Active Directory when using ADFS.\u00a0For more information, see <a href=\"#attributes-adfs\">Attributes for ADFS<\/a>.<\/li>\n<li><strong>Identity URL<\/strong> or <strong>Sign On URL<\/strong> as\u00a0<a href=\"https:\/\/idp.kore.com\"><span class=\"s2\" style=\"color: #0000ff;\">https:\/\/idp.kore.com<\/span><\/a><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<li>Click <strong>Save<\/strong>.<\/li>\n<\/ul>\n<p>The <em class=\"TitleOrPath_Kore.ai\">Identity Provider information successfully updated<\/em> message is displayed at the top of the page.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\r\n\t\t<\/div>\r\n\t<\/div>\r\n<div class=\"w-separator size_small with_line width_default thick_1 style_solid color_border align_center\"><div class=\"w-separator-h\"><\/div><\/div>\r\n\t<div class=\"wpb_text_column \">\r\n\t\t<div class=\"wpb_wrapper\">\r\n\t\t\t<p><strong id=\"attributes-adfs\">Attributes for ADFS<\/strong><br \/>\nWhen you configure Single Sign-On using LDAP for ADFS, in addition to authentication attributes, your third-party SSO provider can send additional attributes to Kore.ai through the <strong>Assertion Consumer Service (ACS) URL<\/strong> or <strong>Callback URL<\/strong>.<\/p>\n<p>If you are using a built-in Kore.ai app for SSO, such as <em>Windows Azure<\/em> for WS-Federation protocol, or <em>OneLogin<\/em> for SAML protocol, required attributes are already configured for Kore.ai when you add the Kore.ai app to your SSO provider admin console.<\/p>\n<p>The following data is an example of attribute data passed to Kore.ai in the callback URL.<\/p>\n<pre class=\"toolbar:1 lang:default decode:true \">&lt;Attribute Name=\"FirstName\" NameFormat=\"urn:oasis:names:tc:SAML:2.0:attrname-format:uri\" FriendlyName=\"First Name\"&gt;\r\n&lt;AttributeValue&gt;Michael&lt;\/AttributeValue&gt;\r\n&lt;\/Attribute&gt;\r\n&lt;Attribute Name=\"LastName\" NameFormat=\"urn:oasis:names:tc:SAML:2.0:attrname-format:uri\" FriendlyName=\"Last Name\"&gt;\r\n&lt;AttributeValue&gt;Mehra&lt;\/AttributeValue&gt;\r\n&lt;\/Attribute&gt;\r\n&lt;Attribute Name=\"DisplayName\" NameFormat=\"urn:oasis:names:tc:SAML:2.0:attrname-format:uri\" FriendlyName=\"Display Name\"&gt;\r\n&lt;AttributeValue&gt;Michael Mehra&lt;\/AttributeValue&gt;\r\n&lt;\/Attribute&gt;\r\n&lt;Attribute Name=\"EmailAddress\" NameFormat=\"urn:oasis:names:tc:SAML:2.0:attrname-format:uri\" FriendlyName=\"Email\"&gt;\r\n&lt;AttributeValue&gt;michael.mehra@acme.com&lt;\/AttributeValue&gt;\r\n&lt;\/Attribute&gt;<\/pre>\n<p>These attributes are optional except for the <code>EmailAddress<\/code>, which is required. The <code>Email Address<\/code> attribute uses the following <code>nameId<\/code> format:<\/p>\n<pre class=\"toolbar:1 lang:default decode:true \">SAML 2.0:\r\nNameID Format=\"urn:oasis:names:tc:SAML:2.0:attrname-format:uri\"\r\nSAML 1.1:\r\nNameID Format=\"urn:oasis:names:tc:SAML:1.1:nameid:format:emailAddress<\/pre>\n<p><strong><span class=\"wysiwyg-font-size-x-large\">Mapping\u00a0Attributes in ADFS<\/span><\/strong><\/p>\n<p>ADFS is a service provided by Microsoft as a standard role for Windows Server that provides a web login using existing Active Directory credentials. When using SAML or WS-Federation protocols to log on with ADFS, you can pass other values in addition to the authentication values.<\/p>\n<p>The attribute values are defined as <strong>Claim Rules<\/strong> in the<strong> Relying Party Trust<\/strong>\u00a0dialog in the SQL Server admin console. To edit the <strong>Claim Rules<\/strong>, select the\u00a0<strong>Relying Party Trusts<\/strong> folder\u00a0in\u00a0<strong>ADFS Management<\/strong>, and then click <strong>Edit Claim Rules <\/strong>from the <strong>Actions\u00a0<\/strong>sidebar. To add a new rule, click\u00a0<strong>Add Rule<\/strong>, and then select the\u00a0<strong>Send LDAP Attributes<\/strong> template. Enter the following mapping values:<\/p>\n<ul>\n<li><strong>SAML 2.0<\/strong>\n<ul>\n<li><strong>LDAP Attribute:<\/strong>\u00a0nameId<\/li>\n<li><strong>Claim Attribute:<\/strong>\u00a0uri<\/li>\n<\/ul>\n<\/li>\n<li><strong>SAML 1.1<\/strong>\n<ul>\n<li><strong>LDAP Attribute:<\/strong>\u00a0nameId<\/li>\n<li><strong>Claim Attribute:<\/strong>\u00a0emailAddress<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\r\n\t\t<\/div>\r\n\t<\/div>\r\n<div class=\"w-separator size_small with_line width_default thick_1 style_solid color_border align_center\"><div class=\"w-separator-h\"><\/div><\/div>\r\n\t<div class=\"wpb_text_column \">\r\n\t\t<div class=\"wpb_wrapper\">\r\n\t\t\t<h2><span class=\"ez-toc-section\" id=\"Logging_On_Using_Your_Admin_Password_Instead_of_SSO\">Logging On Using Your Admin Password Instead of SSO<\/span><\/h2>\n<p>As an Bots Admin, you can enable Single Sign-On (SSO) using a third-party security system, for example, <em>Google<\/em>. If for some reason, your SSO security system fails, or you forget your SSO log on credentials for your third-party security system, you can still log on to the Kore.ai Bots Admin Console and bypass SSO.<\/p>\n<p>A Bots Admin with a custom admin role can only bypass SSO and use their admin password if custom privileges are enabled for at least one module. To log on to the Kore.ai Directory Agent, the custom admin must have privileges enabled for <strong>Enrollment &#8211; Directory Sync<\/strong>.<\/p>\n<p>Before you can enable SSO, the Bots\u00a0Admin must have logged on the Bots\u00a0Admin Console using the log on credentials provided when signing up. After the Bots\u00a0Admin configures and enables SSO, you can still access the Bots\u00a0Admin Console directly at the following URL:<\/p>\n<p class=\"wysiwyg-indent2\" style=\"padding-left: 30px;\"><a href=\"https:\/\/bots.kore.ai\/admin\">https:\/\/bots.kore.ai\/admin<\/a><\/p>\n<p>The following log on page is displayed and using your Bots\u00a0Admin password credentials, you can log on to the Bots Admin Console and bypass SSO, if enabled.<br \/>\n<a ref=\"magnificPopup\" href=\"\/wp-content\/uploads\/sites\/35\/BotsAdminPasswordLogOn.png\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-6824 size-full alignnone\" src=\"\/wp-content\/uploads\/sites\/35\/BotsAdminPasswordLogOn.png\" alt=\"Using Your Password to Log On to the Bots Admin Console without SSO\" width=\"603\" height=\"383\" \/><\/a><br \/>\nIf you cannot remember your Bots\u00a0Admin password, enter your email ID, and then click the\u00a0<strong><span class=\"Link_Kore.ai wysiwyg-color-blue90\" style=\"color: #3366ff;\">Forgot your password?<\/span><\/strong> link shown in the previous image. An email is sent to your Kore.ai email account with instructions on how to reset your Bots\u00a0Admin password.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"Logging_Off\">Logging Off<\/span><\/h3>\n<p>When you are finished with your session with the Bots\u00a0Admin Console, you should log off the console and close your session to keep your bots\u00a0account secure. To log off, click on your user name, and then click <strong>Logout<\/strong> as shown in the following illustration.<br \/>\n<a ref=\"magnificPopup\" href=\"\/wp-content\/uploads\/sites\/35\/EntAdminLogOut-1.png\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-7899 size-full alignnone\" src=\"\/wp-content\/uploads\/sites\/35\/EntAdminLogOut-1.png\" alt=\"Logging out of the Bots Admin Console\" width=\"325\" height=\"126\" \/><\/a><br \/>\nIf your Bots\u00a0Admin Console session is idle for more than 15 minutes, your session is automatically terminated, and the next action in the session window will open the Kore.ai web client instead. To start a new session, click\u00a0the <strong>Bots\u00a0Admin Console<\/strong>\u00a0<img loading=\"lazy\" decoding=\"async\" class=\"icon size-full wp-image-8287\" src=\"\/wp-content\/uploads\/sites\/35\/EntAdminSettingsIcon.png\" alt=\"entadminsettingsicon\" width=\"30\" height=\"30\" \/> icon and log on.<\/p>\n\r\n\t\t<\/div>\r\n\t<\/div>\r\n<div class=\"w-separator size_small with_line width_default thick_1 style_solid color_border align_center\"><div class=\"w-separator-h\"><\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/section><section class=\"l-section wpb_row height_auto\"><div class=\"l-section-h i-cf\"><div class=\"g-cols vc_row type_default valign_top\"><div class=\"vc_col-sm-12 wpb_column vc_column_container\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\r\n\t<div class=\"wpb_text_column \">\r\n\t\t<div class=\"wpb_wrapper\">\r\n\t\t\t\r\n\t\t<\/div>\r\n\t<\/div>\r\n<\/div><\/div><\/div><\/div><\/div><\/section>\n","protected":false},"excerpt":{"rendered":"On the Kore.ai Single Sign-On\u00a0page, in the Security &amp; Control module of the Bots\u00a0Admin Console, you can configure Single Sign-On (SSO)\u00a0authentication for your Kore.ai managed users\u00a0using the following: OpenID Connect Security Assertion Markup Language (SAML) WS-Federation\u00a0sign-on protocol. SSO enables easy access to the Kore.ai application using your existing identity provider. With SSO, your users can...","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[37],"tags":[],"class_list":["post-21200","post","type-post","status-publish","format-standard","hentry","category-security-control"],"_links":{"self":[{"href":"https:\/\/developer.kore.ai\/v10-1\/wp-json\/wp\/v2\/posts\/21200","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/developer.kore.ai\/v10-1\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/developer.kore.ai\/v10-1\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/developer.kore.ai\/v10-1\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/developer.kore.ai\/v10-1\/wp-json\/wp\/v2\/comments?post=21200"}],"version-history":[{"count":36,"href":"https:\/\/developer.kore.ai\/v10-1\/wp-json\/wp\/v2\/posts\/21200\/revisions"}],"predecessor-version":[{"id":61107,"href":"https:\/\/developer.kore.ai\/v10-1\/wp-json\/wp\/v2\/posts\/21200\/revisions\/61107"}],"wp:attachment":[{"href":"https:\/\/developer.kore.ai\/v10-1\/wp-json\/wp\/v2\/media?parent=21200"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/developer.kore.ai\/v10-1\/wp-json\/wp\/v2\/categories?post=21200"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/developer.kore.ai\/v10-1\/wp-json\/wp\/v2\/tags?post=21200"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}