Page Comparison

Target

This guide is intended for organizations with ellie.ai integrated to their Okta platform.

...

1. Sign in onto your Okta admin dashboard with your Okta super admin account

2. Create a new user that we are going to refer as ellie.ai custom user for the rest of this guide

   1. Go to Directory > People

   2. Click on Add person

   3. Fill the form at your convenience, here are some advices but nothing mandatory:

      1. In Activation select “Activate now”

      2. Check “I will set password” and fill the password input

      3. Uncheck “User must change password on first login”

   4. Click on Save

3. Grant ellie.ai custom user a standard admin role

   1. Go to Security > Administrators

   2. Click on Add administrators

   3. In Admin select our newly created ellie.ai custom user

   4. In Role select “Read-only Administrator” (or any other standard admin role as it is just temporary)

   5. Click on Save Changes

4. Sign out from the Okta dashboard

5. Sign in again but this time with your ellie.ai custom user

6. Create a new API token

   1. Go to Security > API

   2. Go to Tokens tab

   3. Click on Create token

   4. Fill in a name (i.e. ellie-api-token)

   5. Click on Create token

   6. Save the token value (This token will be sent to ellie.ai by email)

   7. Click on OK, got it

7. Sign out from the Okta dashboard
   
   We are not done yet, it is important to finish all the steps. You now have an API token, but we are going to downgrade its privileges to the minimal requirements.
   

8. Sign in with your Okta super admin account

9. Create a new custom admin role

   1. Go to Security > Administrators

   2. Go to Roles tab

   3. Click on Create a new role

   4. Fill in a name (i.e. view-users-and-groups-only)

   5. Fill in a description (i.e. “Lets the admin view users and groups details”)

   6. Check in User permissions: “View users and their details”

   7. Check in Group permissions: “View groups and their details”

   8. Click on Save role

10. Create a new resource set (More informations about resource sets below)

    1. Go to Security > Administrators

    2. Go to Resources tab

    3. Click on Create a new resource set

    4. Fill in a name (i.e. ellie-groups)

    5. Fill in a description (i.e. “Constrains to ellie.ai groups only”)

    6. Define the first resource

       1. In Resource type select “Users”

       2. In Group names select all groups assigned to your ellie.ai application (there should be only one group: “ellie”). This group selection will define the list of users ellie.ai can view (it should mirror the list of users assigned to the ellie.ai application).

    7. Click on Add another resource type

    8. Define the second resource

       1. In Resource type select “Groups”

       2. Check “Constrain to all groups” (Recommended, otherwise you will likely have to update this resource type every time you want to change your mapping between groups and ellie.ai roles)

       3. Otherwise, in Group names select the groups ellie.ai can view (i.e. “ellie-read”, “ellie-write”, “ellie-admin” and “ellie”)

    9. Click on Save resource set

11. Downgrade our ellie.ai custom account to our newly created custom admin role

    1. Go to Security > Administrators

    2. Go to Admins tab

    3. Find the ellie.ai custom account in the list

    4. Click on Edit assignments in the Edit dropdown

    5. In Role replace “Read-only Administrator” with the newly created custom role (from step 9)

    6. In Resource set select the newly created resource set (from step 10)

    7. Make sure there is only one role left in the assignments list

    8. Click on Save Changes

...

Ellie.ai will only use {{url}}/api/v1/users/{{userId}}/groups which correspond to an intersection of both scopes. However keep in mind that you are actually giving access to the union of both scopes (view only).

Examples

In purple: what the API token gives access to on the user scope (view only).
In blue: what the API token gives access to on the group scope (view only).
In violet: what ellie.ai is actually going to view (intersection of both scopes).
In rose: what the API token does not have access to on their respective scope.

...