# Join a Terminal Session with Consent | WND Software Docs

Source: https://wndsoftware.com/docs/help-desk

### The help desk joining a session

From a ticket, the help desk sees the person’s session as it is now and, with their say-so, types in it.

In WND Terminal in a browser, a ticket from Send to help desk carries a Join live link that works once, for 15 minutes. The person is asked first and chooses viewing or control. The help desk sees a masked screen, the session is recorded while they’re there, and every key they type is in the audit log under their name.

From a ticket, someone on the help desk can see the person’s session as it is now, and with their say-so, type in it. The person decides, sees who is there, and can end it at any time. The help desk never sees card numbers or other sensitive values, and everything is recorded.

This works for sessions in WND Terminal in a browser, which run on your organization’s gateway.


### How it goes

- The ticket.  The person uses Send to help desk  (or Copy for a ticket ) on the screen with the problem, as usual. On the gateway, the ticket has a line under what they wrote:  `Join live: https://terminal.bank.example/help/482913 The help desk can ask to see this session for the next 15 minutes. I'm asked first. ` The link works once, for 15 minutes.
- The help desk opens the link.  They sign in, if they aren’t already, and wait. Only people in the help desk’s group can use the link.
- The person is asked.  On their session:   Maria Lopez (help desk)  is asking to view your screen in Production. Allow viewing  · Allow viewing and control  · Decline
- Viewing.  The help desk sees the screen as it changes, with card numbers, Social Security numbers, e-mail addresses, long account numbers, passwords typed into commands and your organization’s MaskPatterns hidden. Password fields are blank. It’s the same masking session recordings use. The person’s own screen doesn’t change.
- Control.  The help desk clicks Ask for control . The person sees "Maria Lopez (help desk) is asking for control of Production" and chooses Allow  or Decline . With control, the session gets a coloured border and a Take back control  button. What the help desk types goes to the session as the person’s, and each key is in the audit log with the help desk’s name. Allow viewing and control  at the start gives control straight away.
- The end.  Either side ends it (End , or Leave ). It also ends after 60 minutes, when the session closes, or when the person’s window closes.

While the help desk is there, the session is recorded, whatever the recording policy says, and the recording names the ticket’s code. The person sees the recording mark on the tab, and the banner says so.


### For IT

Turn it on in the gateway’s configuration (`gateway.toml`):


```text
[helpdesk]
group = "WND Help Desk"
join_minutes = 15
max_minutes = 60
```

On a small screen, swipe the table to read all columns.


| Setting | Default | What it does |
| --- | --- | --- |
| `group` | none | The help desk’s group, as your identity provider sends it in the ID token’s groups claim (`[sign_in.oidc] groups_claim`), or a local user’s groups. |
| `join_minutes` | `15` | How long a ticket’s Join live link works (1 to 1440). |
| `max_minutes` | `60` | The longest the help desk can stay with a session (1 to 480). |

Local users can be the help desk without a group, with `helpdesk = true` in the users file.


```text
[[user]]
name = "mlopez"
display_name = "Maria Lopez"
password = "$argon2id$..."
helpdesk = true
```

Without a `[helpdesk]` section, tickets have no Join live link and nobody can join a session.

What the help desk sees is masked with the policy’s MaskPatterns  and RecordingMaskPatterns , on top of the built-in card, Social Security number, e-mail and long number masking. Recordings go where the policy’s other recordings go (RecordingFolder , else the gateway’s data folder).


#### The audit log

In order, for one visit:

On a small screen, swipe the table to read all columns.


| Event | Who | When |
| --- | --- | --- |
| `helpdesk.join_requested` | the help desk | They opened the link. `refused` when they aren’t in the help desk’s group, or the code is wrong, used or expired. |
| `helpdesk.join_allowed` | the person | With `mode`: `view` or `control`. |
| `helpdesk.join_declined` | the person | They said no. |
| `helpdesk.control_requested` | the help desk | They asked for control. |
| `helpdesk.control_allowed` | the person |  |
| `helpdesk.control_declined` | the person |  |
| `helpdesk.key` | the help desk | Each key typed with control: `typed` is the key’s name, or how many characters (never the characters), and `as_user` is the person. |
| `helpdesk.control_taken_back` | the person |  |
| `helpdesk.ended` | whoever ended it | With `by` (`help desk`, `person`, `time limit`, `session closed`, `no answer`) and `minutes`. |

Every event has the ticket’s `code`, the help desk’s login (`helpdesk_user`), the person’s (`person`), and the session’s name, host and port. `session.recording.start` and `session.recording.stop` mark the recording, as for any other.


#### Security

- Only the help desk can join, only with a code from the person’s own ticket, only once, and only for `join_minutes`. Codes tried are limited to 10 a minute for each help desk login.
- The person says yes first, every time. Nothing is shown before.
- The help desk gets the masked screen only. Never the raw screen, never what’s in a password field.
- Control is the person’s to give and take back. Keys from the help desk are in the audit log with who typed them.
- The session is recorded for as long as the help desk is there.


### The protocol

Over the same WebSocket as everything else. Nothing that was there changes.

On a small screen, swipe the table to read all columns.


| Message | Who sends it | What it does |
| --- | --- | --- |
| `viewer.join` `{code}` | the help desk | Join with a ticket’s code, and wait. |
| `viewer.consent` `{request, allow}` | the person | `view`, `control` or `decline`. |
| `viewer.control` `{request, action}` | either | `request` (the help desk), `allow`, `decline` or `take_back` (the person). |
| `viewer.input` `{request, text \| key \| aid \| vt_key}` | the help desk | Type, with control. |
| `viewer.leave` `{request}` | either | End it. |
| event `screen.viewer` `{request, session, view}` | to the help desk | The screen, masked. |

Each side also gets events named `viewer.join`, `viewer.consent`, `viewer.control` and `viewer.leave` as things change.


### Related

[Send to help desk Masked tickets to ServiceNow, Jira or e-mail. Read →](https://wndsoftware.com/send-to-help-desk)
[Roaming sessions Sessions that follow the person between devices. Read →](https://wndsoftware.com/docs/roaming)
[Session recording Tamper-evident recordings in your storage. Read →](https://wndsoftware.com/session-recording)

### Questions


#### Can the help desk see a session without asking?

No. The person says yes first, every time, and nothing is shown before.


#### What does the help desk see?

The masked screen only. Card numbers, Social Security numbers, e-mail addresses, long account numbers and your MaskPatterns are hidden, and password fields are blank.


#### Does this work in the desktop app?

It works for sessions in WND Terminal in a browser, which run on your organization’s gateway.

Technical reviewer: [Albert Joseph](https://wndsoftware.com/authors/albert-joseph), WND Software.