Users Authentication Version 1.4 Release Notes
New Features
A New Home for Security and Authentication Settings
The new Security and Authentication application lets you configure Bright Pattern Contact Center as a single sign-on (SSO) identity provider.
For password, account lockout, and multi-factor authentication rules, the application is a second way to manage the settings found on the Contact Center Administrator's Security Policy page. Those existing screens remain available, so you can use either.
You can open Security and Authentication directly at <your contact center URL>/auth/settings, or reach it through Global Navigation.
Opening these settings requires the Manage roles and security settings privilege. Adding, editing, or deleting application registrations additionally requires the Manage users, Manage all services and campaigns, and Manage all teams privileges.
|
Every successful save in Security and Authentication is recorded, but these records do not appear in the current audit log. They will become visible in an upcoming audit logging version. | |
Register Applications for Internal SSO
Bright Pattern Contact Center can now act as an SSO identity provider for other applications. The Applications for Internal SSO page lets you register an application so its users can sign in with their Bright Pattern Contact Center credentials through the standard OpenID Connect flow, without needing a separate account.
Each registration has a Name, one or more Callback URLs, and generated credentials (a Client ID and Client Secret). You can add, review, edit, and delete registrations from this page.
Register Applications for API Access
The new Applications for API Access page lets you register applications that call the Bright Pattern Contact Center APIs. Each application authenticates with generated credentials and an access token, and acts on behalf of an Associated User, so its API access carries that user's permissions.
In addition to a Name and Associated User, you can set the Access Token Valid For period (from 1 hour to 12 months, 6 months by default). After creating the application, you can generate its access token from the review dialog.
When you delete an API application, all of its tokens are invalidated.
|
|
No Bright Pattern Contact Center application accepts these tokens yet. You can register applications now, but the ability to authenticate with the tokens they generate arrives in a following release. | |
Restrict System Provider Access
A new Restrict system provider access option on the System Access Restrictions page lets you block system provider staff (the operations and support personnel who administer the platform) from signing in to your tenant's applications with their own credentials.
When the option is enabled, any such sign-in is refused with a generic Access Denied message and the unsuccessful attempt is recorded. As with other records written by Security and Authentication, it will not be visible until the upcoming audit logging version. By default, the option is disabled, so operations and support staff can still sign in this way.
|
|
If you need help from operations or support staff with a problem that requires signing in to your tenant, you must either create dedicated user accounts or turn the option off. | |
Descriptions for IP Address Ranges
When defining IP address ranges on the System Access Restrictions page, you can now add an optional Description to each range, for example, the name of an office location. The description makes it easier to identify and maintain your ranges.
Automatic MFA Code Delivery after Sign-in
Users who have email configured as their second factor are now sent a multi-factor authentication (MFA) code automatically, as soon as they submit their username and password. The button on the code-entry screen now reads Resend rather than Send. A resend attempt made immediately after sign-in is rejected, and the user is told to wait before requesting another code. Users whose second factor is a time-based one-time password (TOTP) are not sent a code. They are prompted to enter the code shown in their authenticator application. MFA is configured on the Security Policy page.
Session Control for Single-Session Applications
When a user signs in through external SSO to a single-session application (such as the Agent Desktop) while they already have another single-session application active, they are now prompted with a choice. Selecting Force Login signs them in and ends the other session, while selecting Cancel returns them to a page from which they can sign in again.
Additional Security Hardening
This release strengthens how authentication data is stored and how internal services communicate with one another. These changes are internal to the platform, require no configuration, and do not change existing behavior.