Security and Control

Documentation Index

Fetch the complete documentation index at: https://koreai.mintlify.app/llms.txt

Use this file to discover all available pages before exploring further.

​

Single Sign-On (SSO)

​

Enable SSO

1. Go to Admin Console > Security > Single Sign-On.
2. Turn on the Enable SSO toggle.
3. Select a sign-on protocol.
4. Select your identity provider and enter the configuration details.
5. Click Save.

​

SAML

​

Okta

1. Log in to the Okta Admin Dashboard.
2. Go to Applications > Add Application > Create Application.
3. Enter an App Name and click Next.
4. Under Configure SAML, paste the ACS URL for SP-Initiated SAML Flow from the platform into the Okta Single Sign-On URL field.
   • For on-premise accounts, use https://idproxy-dev.<platform>.com/authorize/callback as the SSO URL and https://idproxy-dev.<platform>.com as the Audience URL.
5. Click Finish.
6. On the Sign On tab, click View Setup Instructions and copy:
   • Identity Provider Single Sign-On URL → Okta Single Sign-On URL on the platform
   • Identity Provider Issuer → Identity Provider Issuer on the platform
   • X.509 Certificate → Certificate on the platform
7. Click Save.

​

OneLogin

1. In the OneLogin Portal, go to Applications > Add Apps, search for your app, and save it.
2. On the SSO tab, copy:
   • OneLogin SAML 2.0 Endpoint (HTTP) → SAML 2.0 Endpoint on the platform
   • OneLogin Issuer URL → Issuer URL on the platform
3. Click View Details on the X.509 Certificate field. Copy the certificate data (between the header and footer lines) and paste it into the X.509 Certificate field on the platform.
4. Copy the ACS URL for SP-Initiated SAML Flow and ACS URL for IDP-Initiated SAML Flow from the platform and paste them into the corresponding fields in OneLogin.
5. Click Save in both the platform and OneLogin.

​

Bitium

1. In Bitium, go to Manage Organization > Manage Apps > App.
2. On the Single Sign-On tab, select SAML Authentication.
3. Copy:
   • Bitium Login URL → Single Sign-On URL on the platform
   • Bitium Logout URL → Issuer URL on the platform
   • X.509 Certificate → Certificate on the platform
4. Click Save.

​

Other SAML Providers

​

WS-Federation

​

Windows Azure

1. Log in to the Azure Portal and go to Microsoft Entra ID > Enterprise Applications > New Application > Create your own application.
2. Enter the application name and click Create.
3. Go to Single sign-on and select WS-Fed.
4. Configure the Identifier (Entity ID) and Reply URL provided by the platform.
5. Go to Users and Groups and assign users or groups.
6. Go to App Registrations > Endpoints and copy:
   • WS-Federation Sign-On Endpoint → Azure AD Sign-On Endpoint URL on the platform
   • Federation Metadata Document URL → Azure AD Federation Metadata Document on the platform
7. Click Save.

​

Other WS-Federation Providers (ADFS)

1. Open ADFS Management on your ADFS server. Right-click Relying Party Trusts and select Add Relying Party Trust.
2. Choose Enter data about the relying party manually and click Next.
3. Select AD FS profile and skip certificate configuration.
4. Enable WS-Federation Passive protocol and enter the Relying Party WS-Federation Passive protocol URL provided by the platform.
5. Enter the relying party trust identifier provided by the platform.
6. In Edit Claim Rules, click Add Rule, select Send LDAP Attributes as Claims, and map:
   • E-Mail-Addresses → E-Mail Address
   • Given-Name → Given Name
   • Surname → Surname
   • User-Principal-Name → UPN
7. Add another rule: select Transform an Incoming Claim, set Incoming claim type to E-Mail Address, Outgoing claim type to Name ID, and Outgoing name ID format to Email.
8. In Service > Endpoints, copy:
   • WS-Federation Passive Endpoint (/adfs/ls/) → AD Sign-On Endpoint URL on the platform
   • Federation Metadata URL → AD Federation Metadata Document URL on the platform
9. Click Save.

​

OpenID Connect (OIDC)

​

Google

1. Log in to Google Cloud Console.
2. Go to IAM & Admin > Service Accounts > Create Service Account. Enter a name, click Create and Continue, then Done.
3. Click the service account → Keys > Add Key > Create New Key → select JSON → Create. Save the downloaded file securely.
4. In the service account details, enable Google Workspace Domain-wide Delegation and note the Client ID.
5. Log in to Google Admin Console.
6. Go to Security > API Controls > Domain-wide Delegation > Add new.
7. Enter the Client ID and add the following OAuth scopes as a comma-separated list:
   • https://www.googleapis.com/auth/admin.directory.user.readonly
   • https://www.googleapis.com/auth/admin.directory.group.readonly
   • https://www.googleapis.com/auth/admin.directory.orgunit.readonly
   • https://www.googleapis.com/auth/admin.directory.domain.readonly
8. Click Authorize.
9. In the platform, select Sign in with Google, enable Configure service account for your G-Suite domain, and enter the values from the JSON key file:
   • client_email → Client Email
   • private_key → Private Key
   • Admin email → Admin Email
10. Click Save.

​

Microsoft Azure

1. Log in to the Azure Portal and go to Microsoft Entra ID > App Registrations > New Registration.
2. Enter an application name and add the Redirect URL from the platform as the redirect URI. Click Register.
3. Under Authentication, enable ID Tokens under Implicit grant and hybrid flows.
4. Under Certificates & Secrets, create a new client secret. Copy the Value immediately — it is shown only once.
5. Under API Permissions, add Microsoft Graph delegated permissions: User.Read, email, openid, profile. Click Grant Admin Consent.
6. From the app Overview page, copy the Application (client) ID and Directory (tenant) ID.
7. In the platform, select Microsoft Azure, enter the credentials, and click Save.

​

Service Accounts

​

Add a Service Account

​

Google

​

Microsoft Azure

1. Log in to the Azure Portal and search for App Registrations.
2. Click New Registration, enter an application name, select the tenant type (Single or Multi-tenant), and click Register.
3. Go to API Permissions > Add a Permission > Microsoft Graph > Application Permissions and add the required permissions above.
4. Click Grant Admin Consent for [Your Organization].
5. Go to Certificates & Secrets > New Client Secret. Select an expiration period and click Add. Copy the Value immediately.
6. From the app Overview, copy the Application (client) ID and Directory (tenant) ID.

​

LDAP

​

Okta

• If the credentials are valid, the service account saves successfully.
• If the credentials are invalid, the platform displays an error message and does not save the account.

​

Manage Service Accounts

​

Enterprise Encryption

​

Default Key

• Copy — Copy the current key to your clipboard.
• Refresh — Generate a new default key.

​

Bring Your Own Key (BYOK)

​

Configure BYOK

1. Go to Admin Console > Enterprise Encryption.
2. Under Bring Your Own Key, click Create Key.
3. Select your cloud provider (AWS or Azure).
4. Note the pre-populated values shown by the platform — these are required when configuring your cloud provider.
5. Enter the required identifiers (see provider sections below).
6. Click Test Connection to validate key access and permissions.
7. Click Next, then Proceed to activate.

​

AWS KMS

1. Locate your Customer Managed Key (CMK) ARN. The platform uses this key for all encryption operations. In the AWS KMS console, open your CMK’s details page and copy the CMK ARN (e.g., arn:aws:kms:<region>:<account-id>:key/<key-id>).
2. Create an IAM role for the platform. This role allows the platform to securely access your KMS key without sharing credentials. Go to IAM > Roles > Create Role, select Another AWS account, enter the Service Role ARN provided by the platform, and name the role (e.g., AIforWorkByokAccessRole). Note the Role ARN after creation.
3. Configure the trust policy on the role. The trust policy restricts who can assume this role. By specifying the platform’s Service Role ARN and the External ID, you ensure that only the platform’s verified service can use it. Go to IAM > Roles > Your role > Trust Relationships > Edit Trust Policy and set the following (replace placeholders with actual values):
   {
     "Version": "2012-10-17",
     "Statement": [{
       "Effect": "Allow",
       "Principal": { "AWS": "<Service-Role-ARN>" },
       "Action": "sts:AssumeRole",
       "Condition": { "StringEquals": { "sts:ExternalId": "<External-ID>" } }
     }]
   }
   
4. Create and attach a permissions policy. This policy defines which KMS actions the role is allowed to perform on your key. Go to IAM > Policies > Create Policy > JSON and add the following:
   {
     "Version": "2012-10-17",
     "Statement": [{
       "Sid": "AllowKMSActions",
       "Effect": "Allow",
       "Action": ["kms:Encrypt", "kms:Decrypt", "kms:ReEncrypt*", "kms:GenerateDataKey*", "kms:DescribeKey"],
       "Resource": "<your-cmk-arn>"
     }]
   }
   
   Name the policy (e.g., AIKMSPolicy), create it, then attach it to the role via IAM > Roles > Your role > Add Permissions > Attach Policies.
5. Grant the IAM role access in the CMK key policy. This authorizes the role to perform cryptographic operations on the key from the KMS side. In the KMS console, select your CMK, go to the Key Policy tab, switch to edit mode, and add the following statement to the existing policy’s Statement array:
   {
     "Sid": "AllowAIAccess",
     "Effect": "Allow",
     "Principal": { "AWS": "<your-role-arn>" },
     "Action": ["kms:Encrypt", "kms:Decrypt", "kms:ReEncrypt*", "kms:GenerateDataKey*", "kms:DescribeKey"],
     "Resource": "*"
   }
   
6. Validate the configuration (optional). Run the following AWS CLI commands to verify that your IAM role and CMK key policy are set up correctly. This step does not validate the full BYOK integration.
   aws sts assume-role \
     --role-arn arn:aws:iam::<your-account-id>:role/<role-name> \
     --role-session-name test-session
   
   aws kms describe-key \
     --key-id <your-cmk-arn> \
     --region <your-region>
   
7. Share your details with Kore.ai. Contact Support and provide your CMK ARN (from step 1) and Role ARN (from step 2). The team will configure the service side to assume the role and securely access your KMS key. Once this is done, the BYOK configuration and test connection will complete successfully.

​

Azure Key Vault

1. Authorize the platform in your Azure tenant. This step registers the platform as a service principal in your tenant, allowing it to interact with your Key Vault securely. Sign in to the Azure portal as a Global Administrator and grant admin consent for the platform’s application using one of:
   • Admin Consent URL: Navigate to https://login.microsoftonline.com/<your-tenant-id>/adminconsent?client_id=<platform-client-id> (replace <your-tenant-id> with your tenant ID, found in Microsoft Entra ID > Properties).
   • Azure CLI: Run az ad sp create --id '<platform-client-id>' (replace <platform-client-id> with the Client ID provided by the platform).
2. Prepare your Key Vault and encryption key. Ensure you have a Key Vault and an RSA key in your Azure subscription. Note the following details, which you will share with the team:
   • Key Vault URI (e.g., https://<vault-name>.vault.azure.net/)
   • Key Name for the specific key the platform will use
3. Grant the platform access to your Key Vault. This authorizes the platform’s service principal to perform the cryptographic operations required for BYOK. In your Key Vault, go to Access Control (IAM) > Add Role Assignment and assign the following roles to the platform’s service principal (search by the App Name or Client ID provided by the platform):
   • Key Vault Crypto User — allows cryptographic operations like wrapping and unwrapping keys, required for BYOK functionality
   • Key Vault Reader — allows reading metadata about the Key Vault and its resources
4. Share your details with Kore.ai. Contact Support and provide: your Tenant ID (found in Microsoft Entra ID > Properties), the Key Vault URI, and the Key Name.
5. Approve the private endpoint connection. After the team configures the connection on their end, a private endpoint request will appear in your Key Vault. Go to Key Vault > Networking > Private Endpoint Connections, find the pending request, and approve it. This establishes a secure private link between the platform and your Key Vault.

​

Data Settings

​

Conversation Data Storage

​

Data Retention Period

​

Domain Management

​

Domain Types

​

Add a Domain

1. Click Add New.
2. Select the domain type (Company or Partner).
3. Enter the domain details and submit for verification.
4. Verified domains are added to the account. Rejected domains remain listed with a Rejected status.

​

Access Rules

​

Switching Accounts (Partner Users)

​

Personal API Key

​

Manage Your Key

​

Authenticate API Requests

--header 'auth: {{Admin's Personalkey}}'