{"id":60952,"date":"2024-01-06T03:54:49","date_gmt":"2024-01-06T03:54:49","guid":{"rendered":"https:\/\/developer.kore.ai\/v10-1\/?p=60952"},"modified":"2024-01-08T06:52:55","modified_gmt":"2024-01-08T06:52:55","slug":"setting-up-the-kerberos-spnego-authorization-profile","status":"publish","type":"post","link":"https:\/\/developer.kore.ai\/v10-1\/docs\/bots\/advanced-topics\/setting-up-the-kerberos-spnego-authorization-profile\/","title":{"rendered":"Setting Up the Kerberos SPNEGO Authorization Profile"},"content":{"rendered":"<h1><span class=\"ez-toc-section\" id=\"Overview\"><span style=\"font-weight: 400;\">Overview<\/span><\/span><\/h1>\n<p><span style=\"font-weight: 400;\">The XO Platform offers Kerberos SPNEGO-based authentication mechanism for enterprise users to use Kerberos authentication flow to securely connect with their internal applications using Kerberos SPNEGO security protocol.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">The Kerberos-SPNEGO authentication process includes multiple steps to establish a secure connection between a client and a server using the SPNEGO negotiation mechanism and the Kerberos authentication protocol. The combination of SPNEGO and Kerberos ensures a secure and efficient authentication process to enable clients to access sensitive data securely.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">The Kerberos SPNEGO auth profile can be configured from the following XO Platform settings:<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><a href=\"https:\/\/developer.kore.ai\/v10-1\/docs\/bots\/bot-builder-tool\/dialog-task\/working-with-the-service-node\/\"><span style=\"font-weight: 400;\">Service Node<\/span><\/a><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><a href=\"https:\/\/developer.kore.ai\/v10-1\/docs\/bots\/advanced-topics\/authorization\/bot-authentication\/\"><span style=\"font-weight: 400;\">Configurations &gt; Authorization Profile<\/span><\/a><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><a href=\"https:\/\/developer.kore.ai\/v10-1\/docs\/bots\/nlp\/llm-integration\/#Configure_Custom_LLM_Integration\"><span style=\"font-weight: 400;\">Generative AI &amp; LLM &gt; Custom LLM Integrations<\/span><\/a><\/li>\n<\/ul>\n<h1><span class=\"ez-toc-section\" id=\"Configuring_Kerberos_SPNEGO_Authorization\"><span style=\"font-weight: 400;\">Configuring Kerberos SPNEGO Authorization<\/span><\/span><\/h1>\n<p><span style=\"font-weight: 400;\">Steps to configure the Authorization for your assistant with Kerberos-SPNEGO auth profile:<\/span><\/p>\n<ol>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Open the virtual assistant (VA) for which you want to configure the Authorization profile.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Select the <\/span><b>Build<\/b><span style=\"font-weight: 400;\"> tab from the top menu.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">From the left-side vertical menus, click <\/span><b>Configurations &gt; Authorization Profiles<\/b><span style=\"font-weight: 400;\">.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Click<\/span><b> Add<\/b><span style=\"font-weight: 400;\"> to open the <\/span><b>New Authorization Mechanism<\/b><span style=\"font-weight: 400;\"> dialog.<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><br \/>\n<a ref=\"magnificPopup\" href=\"https:\/\/kore-wordpress.s3.us-east-2.amazonaws.com\/developer.kore.ai\/v10-1\/wp-content\/uploads\/sites\/35\/20221003155112\/add-authorization-2-2.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-large wp-image-47392\" src=\"https:\/\/kore-wordpress.s3.us-east-2.amazonaws.com\/developer.kore.ai\/v10-1\/wp-content\/uploads\/sites\/35\/20221003155112\/add-authorization-2-2-1024x456.png\" alt=\"\" width=\"640\" height=\"285\" srcset=\"https:\/\/kore-wordpress.s3.us-east-2.amazonaws.com\/developer.kore.ai\/v10-1\/wp-content\/uploads\/sites\/35\/20221003155112\/add-authorization-2-2-1024x456.png 1024w, https:\/\/kore-wordpress.s3.us-east-2.amazonaws.com\/developer.kore.ai\/v10-1\/wp-content\/uploads\/sites\/35\/20221003155112\/add-authorization-2-2-300x134.png 300w, https:\/\/kore-wordpress.s3.us-east-2.amazonaws.com\/developer.kore.ai\/v10-1\/wp-content\/uploads\/sites\/35\/20221003155112\/add-authorization-2-2.png 1922w\" sizes=\"auto, (max-width: 640px) 100vw, 640px\" \/><\/a><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">In the <\/span><b>Authorization Type<\/b><span style=\"font-weight: 400;\"> drop-down list, select the <\/span><b>Kerberos-SPNEGO <\/b><span style=\"font-weight: 400;\">option.<br \/>\n<a ref=\"magnificPopup\" href=\"https:\/\/kore-wordpress.s3.us-east-2.amazonaws.com\/developer.kore.ai\/v10-1\/wp-content\/uploads\/sites\/35\/20240106035759\/kerberos.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-medium wp-image-60956\" src=\"https:\/\/kore-wordpress.s3.us-east-2.amazonaws.com\/developer.kore.ai\/v10-1\/wp-content\/uploads\/sites\/35\/20240106035759\/kerberos.png\" alt=\"\" width=\"600\" height=\"399\" \/><\/a><\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">In the <\/span><b>Name<\/b><span style=\"font-weight: 400;\"> field, enter a name for the authorization type.<br \/>\n<a ref=\"magnificPopup\" href=\"https:\/\/kore-wordpress.s3.us-east-2.amazonaws.com\/developer.kore.ai\/v10-1\/wp-content\/uploads\/sites\/35\/20240106040004\/kerberos1.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-medium wp-image-60959\" src=\"https:\/\/kore-wordpress.s3.us-east-2.amazonaws.com\/developer.kore.ai\/v10-1\/wp-content\/uploads\/sites\/35\/20240106040004\/kerberos1.png\" alt=\"\" width=\"600\" height=\"399\" \/><\/a><\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Define the required Kerberos Authorization fields. For more information, see the <a href=\"https:\/\/developer.kore.ai\/v10-1\/docs\/bots\/advanced-topics\/setting-up-the-kerberos-spnego-authorization-profile\/#Defining_Authorization_Fields\">Defining Authorization Fields<\/a> section.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\">(optional) Click <b>+ Add Authorization<\/b> <b>Field <\/b>to add additional fields for Kerberos authorization. For more information, see the <a href=\"https:\/\/developer.kore.ai\/v10-1\/docs\/bots\/advanced-topics\/setting-up-the-kerberos-spnego-authorization-profile\/#Adding_Authorization_Fields\">Adding Authorization Fields<\/a> section.<\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\">Click <b>Save Auth<\/b>.<br \/>\n<a ref=\"magnificPopup\" href=\"https:\/\/kore-wordpress.s3.us-east-2.amazonaws.com\/developer.kore.ai\/v10-1\/wp-content\/uploads\/sites\/35\/20240106040327\/kerberos2.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-medium wp-image-60962\" src=\"https:\/\/kore-wordpress.s3.us-east-2.amazonaws.com\/developer.kore.ai\/v10-1\/wp-content\/uploads\/sites\/35\/20240106040327\/kerberos2.png\" alt=\"\" width=\"600\" height=\"399\" \/><\/a><\/li>\n<\/ol>\n<h1><span class=\"ez-toc-section\" id=\"Defining_Authorization_Fields\"><span style=\"font-weight: 400;\">Defining Authorization Fields<\/span><\/span><\/h1>\n<p><span style=\"font-weight: 400;\">To configure the Kerberos SPNEGO authorization profile, define the fields described in the following table.<\/span><\/p>\n<table>\n<tbody>\n<tr>\n<td><b>FIELD NAME<\/b><\/td>\n<td><b>DESCRIPTION<\/b><\/td>\n<td><b>Required or Optional<\/b><\/td>\n<\/tr>\n<tr>\n<td><span style=\"font-weight: 400;\">Authorization Type<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Set to Kerberos SPNEGO<\/span><\/td>\n<td><\/td>\n<\/tr>\n<tr>\n<td><span style=\"font-weight: 400;\">Name<\/span><\/td>\n<td><span style=\"font-weight: 400;\">The name of the authorization profile or service, for example, <\/span><i><span style=\"font-weight: 400;\">Kerberos Profile<\/span><\/i><span style=\"font-weight: 400;\">.\u00a0<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Required<\/span><\/td>\n<\/tr>\n<tr>\n<td><span style=\"font-weight: 400;\">Service Principal URL<\/span><\/td>\n<td><span style=\"font-weight: 400;\">The URL to access the Kerberos service and initiate the authentication process.<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Required<\/span><\/td>\n<\/tr>\n<tr>\n<td><span style=\"font-weight: 400;\">Authorization Check URL<\/span><\/td>\n<td><span style=\"font-weight: 400;\">This is the URL used to obtain end-user authorization for the XO Platform to access the web application or web service using the access token. The XO Platform accepts a valid URL with a maximum length of 3000 characters. This field is required. You can use dynamic fields, path parameter fields, query fields, and so forth, to define the Authorization URL, for example,<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0https:\/\/kore.someCompany.com\/sap\/opu\/odata\/sap\/{{authfield1}}\/?$format=json<\/span><\/p>\n<p><span style=\"font-weight: 400;\">or<\/span><\/p>\n<p><span style=\"font-weight: 400;\">https:\/\/{tenant}.service-now.com\/api\/now\/v1\/table\/incident<\/span><span style=\"font-weight: 400;\"><br \/>\n<\/span><span style=\"font-weight: 400;\">For more information, see <\/span><a href=\"https:\/\/developer.kore.ai\/v10-1\/docs\/bots\/bot-builder-tool\/using-session-and-context-variables-in-tasks\/\"><span style=\"font-weight: 400;\">Using Session and Context Variables in Tasks<\/span><\/a><span style=\"font-weight: 400;\">.<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Required<\/span><\/td>\n<\/tr>\n<tr>\n<td><span style=\"font-weight: 400;\">Authorization Fields<\/span><\/td>\n<td><span style=\"font-weight: 400;\">The authorization fields for the token bearer.<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Optional<\/span><\/td>\n<\/tr>\n<tr>\n<td><span style=\"font-weight: 400;\">Refresh Token URL<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Enter a Refresh Token URL, if required, for cases when the authentication token expires and has to be refreshed. The XO Platform accepts a valid URL with a maximum length of 3000 characters.<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Required<\/span><\/td>\n<\/tr>\n<tr>\n<td><span style=\"font-weight: 400;\">Description<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Enter a description for your authorization.<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Optional<\/span><\/td>\n<\/tr>\n<tr>\n<td><span style=\"font-weight: 400;\">Authentication Types<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Bot designers can set this setting to modify the Kerberos authentication behavior.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Choose one of the following Authentication Types:<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Mutual <\/b><span style=\"font-weight: 400;\">&#8211; By default, this option is selected. The <\/span><b>Mutual <\/b><span style=\"font-weight: 400;\">authentication ensures that both the client and the server authenticate each other during the Kerberos SPNEGO authentication process.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Delegate <\/b><span style=\"font-weight: 400;\">&#8211; The delegate option is also known as delegation or credential delegation. It means the client can pass its Kerberos credentials to the service. The service can then use these credentials to authenticate to other services on behalf of the client.<\/span><\/li>\n<\/ul>\n<\/td>\n<td><span style=\"font-weight: 400;\">Required<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>&nbsp;<\/p>\n<h1><span class=\"ez-toc-section\" id=\"Adding_Authorization_Fields\"><span style=\"font-weight: 400;\">Adding Authorization Fields<\/span><\/span><\/h1>\n<p><span style=\"font-weight: 400;\">Click +<\/span><b>Add<\/b> <b>Authorization Field<\/b><span style=\"font-weight: 400;\"> and then enter one or more key\/value pairs that represent additional authorization input fields.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">If, for example, the default username and password fields do not meet your needs for authorization input, you can add custom fields as key\/value pairs that are displayed to the end-user by adding <\/span><b>Additional Fields<\/b><span style=\"font-weight: 400;\">. You can use these fields, for example, if a PIN code is required in the authorization process, in addition to the <\/span><b>Username<\/b><span style=\"font-weight: 400;\"> and <\/span><b>Password<\/b><span style=\"font-weight: 400;\"> fields.<\/span><\/p>\n<p><b>Authorization Fields<\/b><span style=\"font-weight: 400;\"> are added, as shown in the following illustration.<br \/>\n<a ref=\"magnificPopup\" href=\"https:\/\/kore-wordpress.s3.us-east-2.amazonaws.com\/developer.kore.ai\/v10-1\/wp-content\/uploads\/sites\/35\/20240106040532\/kerberos3.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-medium wp-image-60965\" src=\"https:\/\/kore-wordpress.s3.us-east-2.amazonaws.com\/developer.kore.ai\/v10-1\/wp-content\/uploads\/sites\/35\/20240106040532\/kerberos3.png\" alt=\"\" width=\"500\" height=\"375\" \/><\/a><\/span><\/p>\n<p><span style=\"font-weight: 400;\">Specify the following fields:<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Field Type <\/b><span style=\"font-weight: 400;\">\u00a0\u2013\u00a0 The type of the custom field. Field type can be <\/span><i><span style=\"font-weight: 400;\">Header<\/span><\/i><span style=\"font-weight: 400;\">, <\/span><i><span style=\"font-weight: 400;\">Payload<\/span><\/i><span style=\"font-weight: 400;\">, <\/span><i><span style=\"font-weight: 400;\">Query String,<\/span><\/i><span style=\"font-weight: 400;\"> or <\/span><i><span style=\"font-weight: 400;\">Path Param<\/span><\/i><span style=\"font-weight: 400;\">.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Field Key<\/b><span style=\"font-weight: 400;\"> \u2013 The name of the custom field.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Value<\/b><span style=\"font-weight: 400;\"> \u2013 The value of the custom field.<\/span><\/li>\n<\/ul>\n<p><span style=\"font-weight: 400;\">Click <\/span><b>Done <\/b><span style=\"font-weight: 400;\">to save the <\/span><b>Additional Field<\/b><span style=\"font-weight: 400;\">.<\/span><\/p>\n<h1><span class=\"ez-toc-section\" id=\"Testing_the_Authorization\"><span style=\"font-weight: 400;\">Testing the Authorization<\/span><\/span><\/h1>\n<p><span style=\"font-weight: 400;\">After you save the authentication, you can test your authorization definition on the <\/span><b>Authentication<\/b><span style=\"font-weight: 400;\"> page when you click <\/span><b>Test <\/b><span style=\"font-weight: 400;\">before continuing to develop the remaining steps of your task.\u00a0<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Steps to test the Kerberos Auth Profile:<\/span><\/p>\n<ol>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Click on the <\/span><b>Test <\/b><span style=\"font-weight: 400;\">button<\/span> <span style=\"font-weight: 400;\">in the Kerberos Auth Profile row to begin the authorization test.<br \/>\n<a ref=\"magnificPopup\" href=\"https:\/\/kore-wordpress.s3.us-east-2.amazonaws.com\/developer.kore.ai\/v10-1\/wp-content\/uploads\/sites\/35\/20240106040957\/kerberos4.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-medium wp-image-60968\" src=\"https:\/\/kore-wordpress.s3.us-east-2.amazonaws.com\/developer.kore.ai\/v10-1\/wp-content\/uploads\/sites\/35\/20240106040957\/kerberos4.png\" alt=\"\" width=\"600\" height=\"399\" \/><\/a><\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">In the Test Authorization window, select the Content-Type and Method field values and click <\/span><b>Test<\/b><span style=\"font-weight: 400;\">.<br \/>\n<a ref=\"magnificPopup\" href=\"https:\/\/kore-wordpress.s3.us-east-2.amazonaws.com\/developer.kore.ai\/v10-1\/wp-content\/uploads\/sites\/35\/20240106041213\/kerberos5.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-medium wp-image-60971\" src=\"https:\/\/kore-wordpress.s3.us-east-2.amazonaws.com\/developer.kore.ai\/v10-1\/wp-content\/uploads\/sites\/35\/20240106041213\/kerberos5.png\" alt=\"\" width=\"504\" height=\"350\" \/><\/a><\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">When the validation of authentication is complete, the <\/span><b>Test Authorization<\/b><span style=\"font-weight: 400;\"> dialog is closed, and the results of the validation, either success or failure, is displayed to the immediate right of the <\/span><b>Test Authorization<\/b><span style=\"font-weight: 400;\"> button. If the authorization fails, the <\/span><i><span style=\"font-weight: 400;\">Auth Test Failed<\/span><\/i><span style=\"font-weight: 400;\"> message is displayed along with the <\/span><b>Headers<\/b><span style=\"font-weight: 400;\"> and <\/span><b>Response<\/b><span style=\"font-weight: 400;\"> tabs.<\/span><\/li>\n<\/ol>\n","protected":false},"excerpt":{"rendered":"<p>Overview The XO Platform offers Kerberos SPNEGO-based authentication mechanism for enterprise users to use Kerberos authentication flow to securely connect with their internal applications using Kerberos SPNEGO security protocol. The Kerberos-SPNEGO authentication process includes multiple steps to establish a secure connection between a client and a server using the SPNEGO negotiation mechanism and the Kerberos&#8230;<\/p>\n","protected":false},"author":17,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[15],"tags":[],"class_list":["post-60952","post","type-post","status-publish","format-standard","hentry","category-advanced-topics"],"_links":{"self":[{"href":"https:\/\/developer.kore.ai\/v10-1\/wp-json\/wp\/v2\/posts\/60952","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/developer.kore.ai\/v10-1\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/developer.kore.ai\/v10-1\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/developer.kore.ai\/v10-1\/wp-json\/wp\/v2\/users\/17"}],"replies":[{"embeddable":true,"href":"https:\/\/developer.kore.ai\/v10-1\/wp-json\/wp\/v2\/comments?post=60952"}],"version-history":[{"count":5,"href":"https:\/\/developer.kore.ai\/v10-1\/wp-json\/wp\/v2\/posts\/60952\/revisions"}],"predecessor-version":[{"id":60975,"href":"https:\/\/developer.kore.ai\/v10-1\/wp-json\/wp\/v2\/posts\/60952\/revisions\/60975"}],"wp:attachment":[{"href":"https:\/\/developer.kore.ai\/v10-1\/wp-json\/wp\/v2\/media?parent=60952"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/developer.kore.ai\/v10-1\/wp-json\/wp\/v2\/categories?post=60952"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/developer.kore.ai\/v10-1\/wp-json\/wp\/v2\/tags?post=60952"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}