How to enable users for OneIM Chatbot (4381529)

Identity Manager version 10 includes a new AI Chatbot feature available in the top right of the Angular Portal.

How can users gain access to this feature?

To gain access to the new Chatbot feature, users must have the "APIServer_GenAIChatbot" program function. By default, this feature is included in the Application Role "Base Roles" | "Administrators" Application role.

NOTE: The reason that the new program function is only in the Administrators application role is due to Legal. Administrators must be sure to enable this feature carefully as data (user prompts, database schema info, etc) will be sent to the cloud LLM configured. 

If Administrators of Identity Manager wish to create a dedicated Permission Group without granting dull Administrator access, the below steps can be used:

IMPORTANT NOTE: Please understand that data (such as user prompts, database schema information, etc.) will be shared with the LLM configured by the administrator. Creating a custom permission group could also give users unintended access to data they should not be able to see.

1. Create a new Permission Group in Designer.
   1. Under "Permissions" | "Permission Groups"
   2. Click "Create a new object"
   3. Provide a Name under "Permissions Group" and "Description"
   4. Set "Only use for Role Based Authentication" to "TRUE"

1. Assign the Program Function to this new permission group
   1. Select the "Program Function" tab at the bottom to switch from Properties
   2. Expand "ApiServer" and select "ApiServer_GenAIChatbot"

1. Commit these changes to the Database to save them.

1. Open Manager and create a new Application Role
   1. Under "One Identity Manager Application" select "Custom"
   2. Under the "Result List" click the "New" button to create a new object
   3. Provide an "Application Role" name
   4. Select the created Permissions Group created earlier.
      1. NOTE: If the permission group does not appear, the setting "Only use for Role Based Authentication" was NOT set to "True" when creating it.

1. Select an Identity that requires access to the Chatbot
   1. Under "Identities"
   2. Choose the Identity to open the overview
   3. Select the task "Assign One Identity Manager Application Roles"
   4. Expand "Custom" and check the new Application Role created
   5. Save the changes

1. Now the user can use the chatbot