Authentication and Authorization
This topic describes the security measures, authentication procedures and protections in place to ensure access to Administration Platform and by extension Communication Recording Agent is securely authenticated and authorized (for both Uniphore and Uniphore Customer employees).
Uniphore Employee Access
Uniphore employee access is strictly controlled and monitored to ensure data security across the platform.
Strict access policies are centrally controlled by Uniphore Single Sign-On (SSO) using Azure AD with MFA (these access policies are not to be confused with Communication Recording Agent Access Policies which contribute to determining captured call access).
Access to the production cluster is highly restricted, access is only authorized to a small subset of our Cloud Operations and Site Reliability Engineering (SRE) teams ensuring only authorized personnel can manage infrastructure and reliability.
For added security Teleport is deployed for zero trust access and role-based access control (RBAC) to govern actions within the production cluster. Find external information on Teleport here.
Teleport:
Access to Uniphore’s cloud operations in the Production environment is tightly controlled and monitored. All access is routed through Teleport, a security platform that provides secure access to hosts, services, and infrastructure components. Teleport enforces stringent authentication and authorization policies, providing granular access controls and session recording capabilities. This means that all actions performed within the production environment are audited in real-time, ensuring full traceability and accountability for every operation. Access is limited to only authorized personnel, minimizing the attack surface and preventing any unauthorized interactions with critical infrastructure.
Customer Access
Access for Uniphore customers is also controlled at a granular level, authenticated through secure methods to provide stringent and secure access control.
Authentication for our applications is provided by Auth0 by Okta, providing the following advanced security measures. Find external information on Auth0 here.
Bot Detection
Suspicious IP Throttling
Brute Force Protection
Breached Password Detection
Customer access can be configured to use Enterprise Identity (IDP) and SSO, enabling a sync to your existing users to automatically manage Administration Platform users, groups, and subsequently their access, roles, and permissions.
Role-based authorization governs access to various application functionalities, ensuring users can only perform actions aligned with their assigned roles, see Access Management for more information.
At the infrastructure level, we enhance access control by using JWT token inspection through our ingress controllers and service mesh to further safeguard internal services.
Auth0 by Okta:
Uniphore uses Auth0 for the Identity Provider (IDP) on Administration Platform and all applications. Auth0 enables SSO by serving as a centralized identity provider, allowing users to authenticate once and gain access to multiple applications seamlessly. It supports various authentication protocols such as OAuth 2.0, OpenID Connect, and SAML, ensuring secure and standardized communication between the identity provider and the applications. By leveraging these protocols, Auth0 streamlines the user authentication process, enhances security, and improves user experience across different platforms. For more information on using SSO with Auth0, see the Auth0 documentation here.
Auth0 syncs users and groups between an enterprise's user management system and its SSO solution by integrating with directory services like Active Directory, LDAP, or other identity providers. This synchronization is often achieved through protocols such as SCIM (System for Cross-domain Identity Management), ensuring that user attributes and group memberships are consistently updated and maintained across systems in real-time. For more information on Auth0 and SCIM here.
Authentication Architecture
The below diagram shows how Uniphore employees and Uniphore Customer employees access is securely controlled and routed through the system via various protections and safeguarding tools.
