Set Up CXone Authentication Using an External Identity Provider

This page guides you, step-by-step, in setting up authentication for your CXone system using an external identity provider (IdP).

Complete each of these tasks in the order given.

Before You Begin

  • Gain a basic understanding of authentication and authorization concepts and terminology if you've never set up a process like this before.
  • Review the CXone-specific process if this is the first time you've worked with authentication in CXone.
  • Consider your human users and the levels of access they need. Decide whether people with greater access should have greater levels of security.
  • Decide whether you will use custom password requirements, multi-factor authentication (MFA), or both to enforce.
  • Based on your decisions, make a list of login authenticators. The list should include the password requirements and MFA status you want to use for each login authenticator. You don't have to create custom login authenticators if the default login authenticator meets your password management needs.
  • Consider whether you need to include authentication and authorization for applications like bots or intelligent virtual assistants (IVAs). If so, you will need to create access keys.
  • Identify your external IdP. CXone supports both hosted and cloud service IdPs. If necessary, involve your company's authentication experts in this process. There may already be established processes for integrating systems like CXone with your external IdP. Following these processes and meeting your specific security needs is ultimately your responsibility.
  • Define your authentication protocol. CXone supports SAML 2.0 and OpenID Connect.
  • Evaluate the combination of IdP and protocol to ensure your use cases and user flows are supported, and to identify potential issues. This should include actual testing.
  • If you use IdP-initiated authentication, use the following table to determine if your CXoneapplications support it:

    application IdP-Initiated SP-Initiated *Notes
    MAX Yes

    Yes

     

    CXone Agent

    *Yes

    Yes

    IdP-initiated is only supported when users access CXone Agent from the app selector in the CXone product.

    Accessing CXone Agent using the direct URLs requires SP-initiated authentication.

    CXone Agent Embedded, CXone Agent Integrated, CXone Agent for Microsoft Teams, Agent for Service Cloud Voice No Yes  
    Salesforce Agent *No Yes Standalone applications don’t support IdP-initiated.
    CXone Studio Yes Yes  
    Desktop Studio *No Yes Standalone applications don’t support IdP-initiated.
    Developer Portal No Yes  

    All existing and future CXone products support SP-initiated authentication.

Your NICE CXone team can support and guide you in this planning process. Good planning makes for a smoother implementation. Implementing authentication and authorization as immediate needs come up is more likely to lead to issues.

Create External Login Authenticators with SAML 2.0

Required permissions: Login Authenticator Create

To create external login authenticators with OpenID Connect, skip this section. Login authenticators are used to manage password criteria. You can create different login authenticators for different users.

You can use external authentication when you want a user's password to be managed by another system or identity provider. CXone currently supports SAML 2.0 and OpenID Connect federation protocols.

You can set up IdP-initiated authentication or SP-initiated authentication with the steps in this section.

IdP-Initiated Authentication: IdP stands for identity provider. IdP-initiated authentication means that the external identity provider starts the login process.

SP-Initiated Authentication: SP stands for service provider. SP-initiated authentication means that CXone starts the login process.

If you are using Salesforce Agent, then the external identity provider (IdP) must be configured for SP-initiated authentication.

  1. Ensure that you have access to the external identity provider. You will need to create an integration specific to CXone.
  2. Create the integration in the external identity provider. Different systems use different names for these integrations, see specific instructions for Okta or Azure.
    1. You will need to provide an Entity ID which you don't know at this point. Use https://cxone.niceincontact.com/need_to_change as a placeholder.
    2. You will need to provide an ACS URL which you don't know at this point. Use https://cxone.niceincontact.com/need_to_change as a placeholder.
    3. The identity provider will generate a specific URL where SAML requests must be sent. Copy and save this URL to a place where you can find it. You will need to enter this value in later steps.
    4. The identity provider will generate a public signing certificate for the integration. Download the certificate. You will need to use it in later steps.
  3. Create an external login authenticator in CXone.
    1. Click the app selector and select Admin.
    2. Click SecurityLogin Authenticator.
    3. Enter the Name and Description of the login authenticator.
    4. Select SAML as the Authentication Type.
    5. If you select FICAM, the SAML response must have a single AuthnContextClassRef entry. Also, the NamespaceURI of the assertion subject must be: urn:oasis:names:tc:SAML:2.0:assertion. The AuthnContextClassRef and NamespaceURI fields are controlled by the identity provider.
    6. Enter the SAML request Endpoint you received from your provider above as the Endpoint URL.
    7. Click Choose File and select the public signing certificate you received from your provider. This file must be a PEM file. It will be a text file and the first line will contain BEGIN CERTIFICATE with some other text.
    8. Click Save and Activate.
    9. Open the login authenticator.
    10. Note the Entity ID and ACS URL. You will need them when updating your IdP settings.

  4. Update your identity provider settings, replacing the placeholders used above with the values you just noted.

  5. Ensure that the External Identity for each user that uses the login authenticator is set to the correct value.

    Your identity provider determines the value that must be used. The value must match exactly what you put in the External Identity field in CXone.

  6. Have the user log in. They must use the latest login URL. After entering their username they will be directed to the external identity provider if needed.

Create External Login Authenticators with OpenID Connect

Required permissions: Login Authenticator Create

You can use external authentication when you want a user's password to be managed by another system or identity provider. CXone currently supports SAML 2.0 and OpenID Connect federation protocols.

You can set up SP-initiated authentication with the steps in this section.

SP-Initiated Authentication: SP stands for service provider. SP-initiated authentication means that CXone starts the login process.

If you are using Salesforce Agent, then the external identity provider (IdP) must be configured for SP-initiated authentication.

  1. Ensure that you have access to the external identity provider. You will need to create an integration specific to CXone.
  2. Create the integration in the external identity provider.
    1. You will need to provide a Sign-in Redirect URI which you don't know at this point. Use https://cxone.niceincontact.com/need_to_change as a placeholder.
    2. You may need to provide a Sign-out Redirect URI which you don't know at this point. Use https://cxone.niceincontact.com/need_to_change as a placeholder.
    3. The identity provider will generate a Client ID and a Client Secret. Copy and save these values where you can find them. You will need to enter them in later steps.
  3. Create an external login authenticator in CXone.
    1. Click the app selector and select Admin.

    2. Click Login Authenticator.

    3. Click Create New or select the login authenticator you want to edit.
    4. Enter the Name and a Description of the login authenticator.
    5. Select OIDC as the Authentication Type.
    6. If you have a discovery endpoint for your IdP, click Discover Settings. Enter your discovery endpoint and click Discover. The remaining fields are populated for you. Discover Settings does not work with Salesforce discovery endpoints.
    7. Enter your Client Identifier and Client Password. Re-type the password in Client Confirm Password. The Client Identifier is the login ID assigned to your account by your IdP.
    8. If you don't have a discovery endpoint for your IdP, enter your IdP-provided Issuer, JsonWebKeySet Endpoint, Authorization Endpoint, Token Endpoint, UserInfo Endpoint, Revocation Endpoint, and End Session Endpoint.

    9. Select a Client Authentication Method. The method you select must be an authentication method that your IdP supports. If you select private_key_jwt, you must select Enable Encryption and enter your Client Assertion Verification Key.
    10. You can select Enable FICAM Profile to turn on U.S. government-specific settings.
    11. Click Create Login Authenticator to validate the provided information and to link your CXone account to your IdP account.
    12. Open the login authenticator.
    13. Note the Sign-in Redirect URI and Sign-out Redirect URI. You will need them when updating your IdP settings.

  4. Update your identity provider settings, replacing the placeholders used above with the values you just noted.

  5. Ensure that the External Identity for each user that uses the login authenticator is set to the correct value.

    Your identity provider determines the value that must be used. The value must match exactly what you put in the External Identity field in CXone. The value for this field must be in this format: claim(email):{email configured by your IdP}. For example, if the user's email in the IdP is nick.carraway@classics.com, you would enter claim(email):nickcarraway@classics.com.

  6. Have the user log in. They must use the latest login URL. After entering their username they will be directed to the external identity provider, if needed.

  7. When your IdP asks you to authenticate, do so as the user on the IdP you want associated with your currently logged in CXone account.
  8. If your OpenID Connect settings in CXone don't show as validated, use your IdP logs to diagnose the problem.

Linking New Users with Claim-based OpenID Connect

CXone can use a different claim value, like an email address, to establish the user's identity at their first login. CXone then automatically switches to the unique OpenID Connect subject identifier. This allows you to pre-configure a user's federated identity.

PKCE for Front-End Authentication

You may have difficulty using the OpenID Connect authorization code flow. This flow requires a client_secret as part of the token exchange. Coding the client_secret into a web application is a security risk. OpenID Connect allows an alternative flow called PKCE (Proof Key for Code Exchange). PKCE uses a different authentication method. NICE CXone supports PKCE flows for front-end integrations.

Create Security Profiles

Required permissions: Security Profile Create

  1. Use one of the following methods to create the security profile and give it a name: 

    • To create a new blank security profile:

      1. Click the app selector and select Admin.
      2. Go to Security Profiles.
      3. Click Create New.

      4. Enter a unique Name for the security profile.

      5. Enter a Description if you want one.

      6. For Create, select a blank Security Profile.

    • To quickly create a new security profile that copies an existing one:

      1. Click the app selector and select Admin.
      2. Go to Security Profiles.
      3. Open the security profile you want to copy.

      4. Click Copy.

      5. Enter a unique Name for the security profile.

      6. Enter a Description if you want one.

  2. Click Next.

  3. Enable permissions for each product and feature you want users to have. Some permissions, like User Settings and Security, are grouped. To see the permissions inside the groups, click Individual next to the group name.

  4. Click Next.

  5. Enable permissions for each report you want users to have.

  6. Click Next.

  7. Restrict data access by CampaignsClosed A grouping of skills used to run reports., Teams, Assignable Profiles, Groups, and Business UnitsClosed High-level organizational grouping used to manage technical support, billing, and global settings for your CXone environment. For each data type, select whether you want users to access All & Future data of that type, None, or Custom.

  8. If you chose Custom for a data type, use the pop-up window to specify which entities of that data type the users can access. Click Done.

    New campaigns, teams, security profiles, groups, and business units aren't automatically added to custom lists when they're created. You must update the custom list if you want users to access the new data.

  9. Click Next.
  10. Click Create Security Profile.

Create or Edit Users

Required permissions: Users Create

If you are setting up authentication with an external IdP for an existing CXone business unit, you do not have to create new user accounts. You will need to edit user accounts and configure the External Identity Type and Federated Identity fields. This must be done for each user who will authenticate via the external IdP. The fields are explained in step 4 of this task.

When you create new users, you have the option to create new individual users or to upload multiple new user accounts at the same time. These instructions are for creating single users in the Admin application. See Manage Multiple Users at Once for instructions on creating or editing multiple users at the same time.

CXone offers many options and settings so you can customize your users. It's a good idea to read through this entire task and make sure you know which settings you need to configure before you begin.

  1. Click the app selector and select Admin.
  2. Click Users.

  3. Open the new user creation form in one of the following ways: 

    • If you want to create a new user with a blank form, click Create New and select Single User.
    • If you want to create a new user based on an existing user's profile, open that user's profile and click Copy.
  4. Enter the user's First Name, Last Name, Email, Username (in the form of an email address), Security Profile, Team, User will use (timezone), City, and Country. If the fields are available, set the password using the Password and Confirm Password fields. Enter any other information you want to add to the user profile.

  5. Select a login authenticator (LA).

    All users must be assigned to a login authenticator, or they won't be able to log in to CXone.

    The type of LA will determine how the user will log in to CXone. You can set up two types of login authenticators.

    System LAs: Users assigned to a system LA will log in using credentials managed by CXone.

    External LAs: Users assigned to an external LA will complete their log in through an external identity provider (IdP). External LAs are configured with either SAML 2.0 or OpenID Connect.

  6. If you have Integrated Softphone (WebRTC) custom URLs enabled, configure the Integrated Softphone URLs and URL Weights as needed.

  7. Click Save and Continue.
  8. Set the user's Refusal Timeouts for each channel, default Dialing Pattern, and Agent Voice Threshold. If you want to, select Suppress Ringing - Personal Connection.

  9. If your environment enabled for static delivery, set the default number of Concurrent Chats and Auto-Parked Emails. Specify whether the user can Request Contact.

  10. If your environment is enabled for dynamic delivery, set the maximum number of simultaneous contacts the user can handle per channel. If you have granular dynamic delivery settings enabled, set the Delivery Mode and Total Contact Count for the user.

  11. If you have a WFO integration enabled other than CXone WFO (such as Uptivity WFO) and want to set up recording, enter the System Domain, System Username, and Phones.

  12. In the MAX Version section, you can determine which version of MAX you want this user to use.
  13. If you have CXone WFM enabled, configure the agent's notification settings.

  14. If you have NICE CXone WFO and you want to integrate with a CRM, enter the agent's CRM Username to associate it with the user.

  15. Click Save.

Authenticate Applications

Users and applications are authenticated in very similar ways. The main difference is that applications are authenticated with an access key while users are authenticated with a username and password. Unlike users, applications are not required to interact through a browser. Applications typically are either back-office functionality or intelligent virtual agentsClosed Chatbot or similar application that interacts with a user based on artificial intelligence (IVAs).

To set up an application to interact with CXone, create a user profile and name the profile after the application. Then create an access key for the application user as follows:

Authorization in CXone

Authorization is the process of verifying what resources a user is allowed to access. Resources can include applications, files, and data. You can define users' access to resources with role-based access control. CXone manages authorization automatically during authentication. When a user is authenticated they are given access only to the resources they're authorized for.

A user's authentication method doesn't impact authorization. CXone uses the same authorization process for all users. It doesn't matter whether they are authenticated with access keys or passwords.