In today's ever-evolving landscape of cyber threats, it's crucial to validate someone's identity before they use a service. This keeps out unauthorized users and also can personalize user experiences -- because different roles and departments require different experiences. For example, an employee who is in the human resources (HR) department requires access to different services than those for an employee in the security operations center.

Think of a scenario where someone wants to check their upcoming vacation plans or wants to email their payslip using an assistant. Instead of logging in to the corporate portal, they could chat with an artificial intelligence (AI) assistant. And, you can use the same process for external customers. For example, banking customers can perform tasks like increasing their cash withdrawal limits or work with transfers on their accounts.

Component technologies

This use cases uses a mix of technologies including watsonx Assistant, IBM Security Verify, and Azure Functions to seamlessly and easily integrate across products. The code is built by using Python and deployed as an Azure Function. You can also use IBM Code Engine or an AWS Lambda serverless computing service.

watsonx Assistant

IBM WatsonX Assistant is an AI-powered virtual agent that provides customers with fast, consistent, and accurate answers across any messaging platform, application, device, or channel.

Powered by trustworthy large language models (LLMs) as well as an intuitive user interface, watsonx Assistant empowers your teams to build AI-powered voice agents and chatbots that deliver automated self-service support across all channels and touch-points with seamless integration to the tools that power your business.

Azure Functions or IBM Code Engine

Azure Function and IBM Code Engine are event-driven, serverless solutions for stand-alone code that is deployed on a cloud network. They can be run without provisioning or managing servers, thus saving on infrastructure costs. They support many programming languages like Python and Java code. This use case uses Python and deploys the code as an Azure Function. However, you can also use IBM Code Engine or an AWS Lambda serverless computing service.

IBM Security Verify

The IBM Security Verify SaaS platform is a completely cloud-based IAM solution that offers hybrid cloud deployment options. It provides automated, cloud-based and on-premises capabilities for administering identity governance, managing workforce and consumer identity and access, and controlling privileged accounts.

Verify SaaS offers:

Core identity base capabilities for both your workforce and consumers, including adaptive access and advanced authentication capabilities that are powered by IBM Security Trusteer's AI-enabled engine
Single sign-on for centralized access control to cloud and on-premises resources
Adaptive access for risk-based authentication
Advanced authentication for frictionless access
Embedded privacy and consent management capabilities that are prebuilt into easy-to-adopt workflows
Full lifecycle management to connect application access with business governance workflows

You can use this workflow for both internal users or consumers. The workflow can act as a first layer of user verification. Different options are shown depending on the user’s profile. For example, if the user is accessing the assistant as an employee, they receive different options than a user who is a consumer.

Architecture

The following figure shows the high-level architecture of the developed solution. The user (employee or customer) accesses the chatbot through a browser on either their mobile device, laptop, or desktop machine. Before the user can see the personalized services available to them, they must authenticate through IBM Verify. This is done by using Verify REST APIs, is deployed as stand-alone code, and can be invoked through watsonx Assistant. When the authentication is successful, user can see the set of services they can use, and can then proceed with the interaction.

High=level architecture

The following figure shows the assistant workflow in the form of a dialog. It takes certain inputs from the user to invoke the webhook through an Azure Function (Verify REST APIs). If the conditions are met, user name validation, sending the email/SMS one-time (OTP), and validating the OTP is achieved through the webhook.

Workflow

The stand-alone Azure Function is available at Verify. You must provide the tenantid, clientid, and clientsecret to successfully invoke the Verify REST APIs. The following code shows a sample Azure Function.

import logging
import requests
import json
import os
import re
import azure.functions as func
tentantid=os.environ["tenantid"]
clientid=os.environ["clientid"]
clientsecret=os.environ["clientsecret"]
tokenurl = tentantid + ":443/v1.0/endpoint/default/token"
tokenpayload = "grant_type=client_credentials&client_id=" + clientid + "&client_secret=" + clientsecret + "&scope=openid"
headers = {
    'Content-Type': "application/x-www-form-urlencoded"
    }
def main(req: func.HttpRequest) -> func.HttpResponse:
    logging.info('Python HTTP trigger function processed a request.')
    action=req.params.get('action')
    name = req.params.get('name')
    if not name:
        try:
            req_body = req.get_json()
        except ValueError:
            pass
        else:

            action=req_body.get('action')
    if action:
        if(action=='lookup'):
            name = req_body.get('name')
            response=accountlookup(name)
            logging.info(f"Hello inside lookup action, {response}. This HTTP triggered function executed successfully.")
            return func.HttpResponse(json.dumps(response), mimetype="application/json")
        if(action=='initiate_email'):
            method=req_body.get('method')
            mail=req_body.get('mail')
            response=initiate_email(method,mail)
            logging.info(f"Hello inside send email action, {response}. This HTTP triggered function is inside EMail  otp.")
            return func.HttpResponse(json.dumps(response), mimetype="application/json")
        if(action=='initiate_sms'):
            method=req_body.get('method')
            phone=req_body.get('phone')
            response=initiate_sms(method,phone)
            logging.info(f"Hello inside send sms action, {response}. This HTTP triggered function is inside SMS otp.")
            return func.HttpResponse(json.dumps(response), mimetype="application/json")
        if(action=='verify'):
            smssent=req_body.get('smssent')
            emailsent=req_body.get('emailsent')
            trxid=req_body.get('trxid')
            otp=req_body.get('otp')
            if(emailsent==1):
                response=verify_email(trxid,otp)
                logging.info(f"Hello inside email otp action, {response}. This HTTP triggered function is inside EMail verify otp.")
            if(smssent==1):
                response=verify_sms(trxid,otp)
                logging.info(f"Hello inside sms otp action, {response}. This HTTP triggered function is inside SMS verify otp.")
            return func.HttpResponse(json.dumps(response), mimetype="application/json")
    else:
        return func.HttpResponse(
             "This HTTP triggered function executed successfully. Pass an action in the query string or in the request body for a personalized response.",
             status_code=200
        )
def auth():
 response = requests.request("POST", tokenurl, data=tokenpayload, headers=headers)
 return response.json()["access_token"]
def accountlookup(userName):
    access_token = auth()
    url = tentantid + "/v2.0/Users?filter=userName eq \"" + userName + "\""
    payload = ""
    headers = {
        'Authorization': "Bearer "+access_token,
        }
    response = requests.request("GET", url, data=payload, headers=headers)
    userrole=', '.join(response.json()["Resources"][0]["urn:ietf:params:scim:schemas:extension:ibm:2.0:User"]["customAttributes"][0]["values"])
    if response.status_code == 200:
        if response.json()["totalResults"] != 0:
            resp={
                    'message': "I found your account.",
                    'user_email': response.json()["Resources"][0]["emails"][0]["value"],
                    'user_id': response.json()["Resources"][0]["id"],
                    'cell_phone': response.json()["Resources"][0]["phoneNumbers"][0]["value"],
                    'role': userrole,
                    'status_code': 200
            }

        else:
            resp = {'messages': "I'm sorry, I can't find that account. Can you try again?",
                    'status_code': 400
            }
    else:
        resp = {'messages': "Oops... that didnt work.",
                'status_code': 400
        }
    return (resp)
def initiate_sms(method, target):
    access_token = auth()
    url = tentantid + "/v2.0/factors/" + method + "/transient/verifications"
    payload = "{\r\n  \"correlation\": \"4321\",\r\n  \"phoneNumber\": \""+target+"\"\r\n}"
    headers = {
        'Authorization': "Bearer "+access_token,
        'Content-Type': "application/json"
        }
    response = requests.request("POST", url, data=payload, headers=headers)
    if response.status_code == 201:
        resp = {
                    "txnid": response.json()["id"],
                    "correlation": response.json()["correlation"],
                    'status_code': 200
                }
    else:
        resp = {
                'messages': "Nope.. that phone didnt work.",
                'status_code': 400
        }
    return resp
def initiate_email(method, target):
    access_token = auth()
    url = tentantid + "/v2.0/factors/" + method + "/transient/verifications"
    payload = "{\r\n  \"correlation\": \"4321\",\r\n  \"emailAddress\": \""+target+"\"\r\n}"
    headers = {
        'Authorization': "Bearer "+access_token,
        'Content-Type': "application/json"
        }
    response = requests.request("POST", url, data=payload, headers=headers)
    if response.status_code == 201:
        resp = {
                    "txnid": response.json()["id"],
                    "correlation": response.json()["correlation"],
                    'status_code': 200
                }
    else:
        resp = {
                'messages': "Nope.. that email didnt work.",
                'status_code': 400
        }
    return resp
def verify_email(txnid, otp):
    access_token = auth()
    url = tentantid + "/v2.0/factors/emailotp/transient/verifications/" + txnid
    payload = "{\r\n  \"otp\": \"" + otp + "\"\r\n}"
    headers = {
        'Authorization': "Bearer "+access_token,
        'Content-Type': "application/json"
        }
    response = requests.request("POST", url, data=payload, headers=headers)
    if response.status_code == 204:
        resp = {
                    "bbb_verified": "true",
                    'messages':"Perfect, the code was successful. We're good to go!",
                    'status_code': 200
                }
    else:
        resp = {'messages': "Nope.. that didnt work.",
                'status_code': 400}
    return resp
def verify_sms(txnid, otp):
    access_token = auth()
    url = tentantid + "/v2.0/factors/smsotp/transient/verifications/" + txnid
    payload = "{\r\n  \"otp\": \"" + otp + "\"\r\n}"
    headers = {
        'Authorization': "Bearer "+access_token,
        'Content-Type': "application/json"
        }
    response = requests.request("POST", url, data=payload, headers=headers)
    if response.status_code == 204:
        resp = {
                    "bbb_verified": "true",
                    'messages':"Perfect, the code was successful. We're good to go!",
                    'status_code': 200
                }
    else:
        resp = {'messages': "Nope.. that didnt work.",
                'status_code': 400}
    return resp

The following screenshots depict the example dialog workflow in watsonx Assistant.

Entities

Entities

Dialogs

Dialog

Dialog

Dialog

Summary

The workflow described in this article enables you to provide personalized experiences to the users and customers of your specific enterprise. It provides security by ensuring that users are only exposed to and provided access to the services that they are authorized to see based on their role or department. This in turn, provides a seamless experience for your users.

You can read further about IBM Verify. Register for a free trial to get hands-on experience on the product.

Learn more about watsonx Assistant, and try it out.

Personalize your watsonx Assistant experience with IBM Security Verify

Personalize your watsonx Assistant experience with IBM Security Verify