From a ticket, someone on the help desk can see the person’s session as it is now, and with their say-so, type in it. The person decides, sees who is there, and can end it at any time. The help desk never sees card numbers or other sensitive values, and everything is recorded.
This works for sessions in WND Terminal in a browser, which run on your organization’s gateway.
How it goes
-
The ticket. The person uses Send to help desk (or Copy for a ticket) on the screen with the problem, as usual. On the gateway, the ticket has a line under what they wrote:
Join live: https://terminal.bank.example/help/482913 The help desk can ask to see this session for the next 15 minutes. I'm asked first.The link works once, for 15 minutes.
-
The help desk opens the link. They sign in, if they aren’t already, and wait. Only people in the help desk’s group can use the link.
-
The person is asked. On their session:
Maria Lopez (help desk) is asking to view your screen in Production. Allow viewing · Allow viewing and control · Decline
-
Viewing. The help desk sees the screen as it changes, with card numbers, Social Security numbers, e-mail addresses, long account numbers, passwords typed into commands and your organization’s MaskPatterns hidden. Password fields are blank. It’s the same masking session recordings use. The person’s own screen doesn’t change.
-
Control. The help desk clicks Ask for control. The person sees "Maria Lopez (help desk) is asking for control of Production" and chooses Allow or Decline. With control, the session gets a coloured border and a Take back control button. What the help desk types goes to the session as the person’s, and each key is in the audit log with the help desk’s name. Allow viewing and control at the start gives control straight away.
-
The end. Either side ends it (End, or Leave). It also ends after 60 minutes, when the session closes, or when the person’s window closes.
While the help desk is there, the session is recorded, whatever the recording policy says, and the recording names the ticket’s code. The person sees the recording mark on the tab, and the banner says so.
For IT
Turn it on in the gateway’s configuration (gateway.toml):
[helpdesk]
group = "WND Help Desk"
join_minutes = 15
max_minutes = 60
On a small screen, swipe the table to read all columns.
| Setting | Default | What it does |
|---|---|---|
group |
none | The help desk’s group, as your identity provider sends it in the ID token’s groups claim ([sign_in.oidc] groups_claim), or a local user’s groups. |
join_minutes |
15 |
How long a ticket’s Join live link works (1 to 1440). |
max_minutes |
60 |
The longest the help desk can stay with a session (1 to 480). |
Local users can be the help desk without a group, with helpdesk = true in the users file.
[[user]]
name = "mlopez"
display_name = "Maria Lopez"
password = "$argon2id$..."
helpdesk = true
Without a [helpdesk] section, tickets have no Join live link and nobody can join a session.
What the help desk sees is masked with the policy’s MaskPatterns and RecordingMaskPatterns, on top of the built-in card, Social Security number, e-mail and long number masking. Recordings go where the policy’s other recordings go (RecordingFolder, else the gateway’s data folder).
The audit log
In order, for one visit:
On a small screen, swipe the table to read all columns.
| Event | Who | When |
|---|---|---|
helpdesk.join_requested |
the help desk | They opened the link. refused when they aren’t in the help desk’s group, or the code is wrong, used or expired. |
helpdesk.join_allowed |
the person | With mode: view or control. |
helpdesk.join_declined |
the person | They said no. |
helpdesk.control_requested |
the help desk | They asked for control. |
helpdesk.control_allowed |
the person | |
helpdesk.control_declined |
the person | |
helpdesk.key |
the help desk | Each key typed with control: typed is the key’s name, or how many characters (never the characters), and as_user is the person. |
helpdesk.control_taken_back |
the person | |
helpdesk.ended |
whoever ended it | With by (help desk, person, time limit, session closed, no answer) and minutes. |
Every event has the ticket’s code, the help desk’s login (helpdesk_user), the person’s (person), and the session’s name, host and port. session.recording.start and session.recording.stop mark the recording, as for any other.
Security
- Only the help desk can join, only with a code from the person’s own ticket, only once, and only for
join_minutes. Codes tried are limited to 10 a minute for each help desk login. - The person says yes first, every time. Nothing is shown before.
- The help desk gets the masked screen only. Never the raw screen, never what’s in a password field.
- Control is the person’s to give and take back. Keys from the help desk are in the audit log with who typed them.
- The session is recorded for as long as the help desk is there.
The protocol
Over the same WebSocket as everything else. Nothing that was there changes.
On a small screen, swipe the table to read all columns.
| Message | Who sends it | What it does |
|---|---|---|
viewer.join {code} |
the help desk | Join with a ticket’s code, and wait. |
viewer.consent {request, allow} |
the person | view, control or decline. |
viewer.control {request, action} |
either | request (the help desk), allow, decline or take_back (the person). |
viewer.input {request, text | key | aid | vt_key} |
the help desk | Type, with control. |
viewer.leave {request} |
either | End it. |
event screen.viewer {request, session, view} |
to the help desk | The screen, masked. |
Each side also gets events named viewer.join, viewer.consent, viewer.control and viewer.leave as things change.