Single Sign On - SSO - Implementation

admin

All information that comes to Promptchat from an external site is obtained from "Auth user URL"

On the demo site that we use for external authorization, it looks as follows:

See this on https://exauth.promptchat.com

In this case, the User will be logged in with the dynamic role "tester" and with access rights indicated on the screenshot.

Also, I will separately write down all the abilities that can be assigned in a dynamic role:

"manageStatistic",
"manageGoogleAccount",
"manageClient",
"manageChatBoard",
"manageTag",
"manageCampaign",
"manageCalendar",
"manageInstantMessage",
"manageChatbot",
"manageIntegration",
"manageWebChatbotLayout",
"manageShop",
"manageQuickReply",

If the user has a role ID 1 or 2 or 3 then the "abilities" do not need to be specified, because this role is static. For example:

All that is required to connect an external site to Promptchat is setting the site configuration.

The two sites must have the same domain name.

“Auth user URL” - this is a link to a page that provides user data in json format.
“API token for patches” - this is a token used to transfer data in a packet.

Here is an example of a request that you can pass to the promptchat site to populate the data:

curl --location 'https://alpha.exauth.promptchat.com/api/system/batches' \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header 'Authorization: Bearer 9krlzg5d7k00000000000000000000000000' \ --data-raw '{ "patches": [ { "entity": "company", "entity_identifier": 9999, "action": "create", "data": { "name": "123123 ooo" } }, { "entity": "department", "entity_identifier": 5555, "action": "create", "data": { "name": "123123 ooo", "company_id": 9999 } }, { "entity": "department", "entity_identifier": 5556, "action": "create", "data": { "name": "123123 aaa", "company_id": 9999 } }, { "entity": "user", "entity_identifier": "312", "action": "update", "data": { "company_id": 9999, "name": "vasia", "timezone": "Europe/Kiev", "role_id": 2, "email": "myemail+211@gmail.com" } } ] }'

Example of our test site https://exauth.promptchat.com/

admin

id=1 - The role id is reserved for a "System administrator".
id=2 - The role id is reserved for a "Company administrator".
id=3 - The role id is reserved for an "Ooperator".
id>3 - if id higher than 3 for "Custom roles".
You set the id for Custom roles yourself on the external site.
You can see how this is organized on our test external site https://exauth.promptchat.com/admin/roles

Company information is mandatory for all users whose ID is not = 1. If ID = 1, the company is not required, but if it is present, there will be no error, this information will simply be ignored by the system

admin

Custom role creation functionality should be created. It is not necessary. If you do not plan to use custom roles this can be omitted.
On our test site, it looks as follows

admin

Additional info:

The company may not have departments.
The user may not have departments.
The user cannot have departments if they do not exist in the company to which he belongs. Company departments do not depend on whether the user has departments

Clayton

Hi! When we configur external auth on the system there are 3 urls:

Auth user URL
Login page
Logout URL

However it seems that there is another url for sending data:
https://alpha.exauth.promptchat.com/api/system/batches

Is this alpha a fixed suffix, or do we need to configure it on the server/host?

Thanks!

Sware

Clayton

Replied here: https://forum.promptchat.com/d/107-how-to-configure-this-alpha-url-for-sending-batches

Clayton

Hi all!

Once the external auth is configured, how can I customize the whitelabel icons, colors, etc?

Since the system always redirect to the ext auth login page, not to the whitelabel login page anymore.

Thanks!

Sware

From the moment you connect external authorization, you cannot authorize from the promptchat site. You must first log in to the external site as a system administrator. Then you will be automatically authorized on the promptchat chat site as a system administrator and these settings will be available to you

Clayton

Hi all! I took a look at the way you´ve implemented the external auth at the exauth.promptchat.com/me, and there are two configurations that aren´t present in this document the api_token and webhook_url:
{"user":{"id":6,"name":"xxxx","email":"xxx@promptchat.com","timezone":"Europe\/London","role":{"id":1,"name":"System administrator","abilities":[]},"departments":[1,2,3]},"company":{"id":2,"api_token":"xxxx-xxxx-xxxx-xxxx-xxxxxxxx","webhook_url":"https:\/\/exauth.promptchat.com\/api\/get-client-info","name":"Kivi","departments":[{"id":1,"name":"Sale"},{"id":2,"name":"Support"},{"id":3,"name":"Legal"}]}}

Could you tell, where do we get this information?

Thank you!

Alla

Current list of abilities:

"abilities": [
"manageClient",
"manageChatBoard",
"manageTag",
"manageCampaign",
"manageCalendar",
"manageInstantMessage",
"manageChatbot",
"manageIntegration",
"manageWebChatbotLayout",
"manageShop",
"manageQuickReply",
"manageStatistic",
"manageGoogleAccount",
"exportClientCsv",
"pickupAllClients"
]

admin

During authentication through a 3rd party system

Is there a recognition/recording of

the workstation
the user logging in

In the log file somewhere in promptchat during authentication which can be accessed later for security review.

Alla

To authorize a user from a third-party crm system, we use "Auth user URL" (see screenshot).
The system takes the user's data from this URL and receives access through cookies from this URL.

If the user is not authorized, then the system will automatically redirect him to the "Login page" (see screenshot) specified in these external authorization settings.

admin

Ok, so if the CRM asks for user and workstation data , then this data can be passed on to promtpchat via a variable for example?