Call Recording Control Permissions to an Existing Realm

This guide walks you through adding Call Recording Pause/Resume permissions to an existing Keycloak (EF IAM) realm.

Use these steps when the tenant is already set up with agents, users, and groups such as agents_permission and senior_agents_permission, and you only need to add the call_recording_control group and its authorization configuration to the cim client.

What Gets Added

Agent Desk uses manage_call_recording_control to show Pause/Resume on live recorded calls. Users without this scope still see the REC indicator only.

1. Assign Users to the New Group

Reminder: Do not import users from the source realm file.

For each agent who should pause or resume call recording:

1. Go to Users and select the user.

2. Open the Groups tab, then click Join Groups.

3. Select call_recording_control, then click Join.

4. Ask the user to log out and log back in to Agent Desk.

Having agent or supervisor roles alone is not enough. The user must be in the call_recording_control group.

2. Verify Permissions in Keycloak

1. Go to Clients → cim → Authorization → Evaluate.

2. Set:

   • Client: cim

   • User: a test user in call_recording_control

   • Resource: call_recording_control

   • Scope: manage_call_recording_control

3. Click Evaluate.

Repeat for scope view_call_recording_control if needed.

3. Verify Login Response

After the user logs in to Agent Desk, check the login API response. In keycloak_User.permittedResources.Resources, the entry for call_recording_control must include a scopes array:

{
  "rsname": "call_recording_control",
  "scopes": [
    "view_call_recording_control",
    "manage_call_recording_control"
  ]
}

If call_recording_control appears without a scopes array, Pause/Resume will not work. See Troubleshooting below.

4. Verify in Agent Desk

1. Log in as a user assigned to call_recording_control.

2. Place or accept a CX Voice call with recording enabled on the extension.

3. Confirm:

   • REC indicator appears when recording is active.

   • Pause/Resume controls appear for users with manage_call_recording_control.

4. Log in as a user not in the group. REC may show, but Pause/Resume must not be available.

Troubleshooting

Resource appears in login but scopes are empty

Symptom: Login response shows call_recording_control with rsname but no scopes array.

Fix:

1. Edit resource call_recording_control and attach both scopes (section 2.4).

2. Confirm both scope-based permissions exist, are Enabled, and have policies linked (section 2.6).

3. Confirm the user is in group call_recording_control (section 3).

4. Re-run Evaluate in Keycloak (section 4) — must show PERMIT.

5. User must log out and log back in.

Pause/Resume not visible in Agent Desk