Connected Identities

Let the agent use websites that need you to be signed in, without ever giving it your password or session cookies

A connected identity lets the agent use a website that needs you to be signed in, such as an internal wiki or a business application, without giving it your password. You sign in yourself in a window Levee opens. Levee keeps the sign-in on your computer and adds it to the agent's requests to that one site. The agent can act as you on that site, but it never sees your password or your sign-in data.

Without a connected identity, the agent has no browser and none of your accounts, so such sites answer it with "401 Unauthorized" or a login page.

How do I connect a site?

There are two ways.

When the agent needs it

If the agent reaches a site your organisation allows and the site asks for a sign-in, Levee shows a Sign-in required prompt:

The agent needs you to sign in to app.example.com so it can act as you on that site.

Click Sign in… to open the sign-in window.
Click Not now to decline. The agent's request fails as if the site had refused it.

Ahead of time

In Advanced mode:

Open the project's Connected identities tab.
Type the site's address, for example app.example.com.
Click Sign in to a site….

A Sign in window opens on the site's login page.
Sign in exactly as usual, including multi-factor authentication or single sign-on.
When you can see the site as a signed-in user, click the I'm signed in capture button.

Levee stores the sign-in and closes the window. The identity appears in the Connected identities tab marked connected, with the number of cookies (the small pieces of sign-in data the site sets) and when the sign-in expires (session if the site set no expiry).

What does the agent see?

The agent sends ordinary requests to the site. Levee adds your sign-in to requests for that site only, replacing anything the agent tried to send itself.
When the site renews your sign-in, Levee keeps the update and does not pass it to the agent.
The agent cannot read, copy or export your sign-in. Nothing about it is written to the project folder.

It is stored encrypted on your computer, in a folder under %ProgramData%\Vediram\Levee\identities that only the SYSTEM account and administrators can access. If Levee cannot protect that folder, it turns the feature off rather than store sign-ins unprotected.

Each identity belongs to one project. Signing in to a site in one project does nothing for another.

How do I disconnect a site?

Click Revoke next to the identity in the Connected identities tab. Levee deletes the stored sign-in and stops adding it to the agent's requests at once.

Revoking in Levee does not sign you out of the site itself. To end the session on the site, sign out there or end the session from its security settings.

Sign-ins also stop working when the site expires them. Sign in again to renew.

Limits

Connected identities work for sites that keep your sign-in in browser cookies, which covers most web applications. Sites that use a token or key you paste in are not covered; use a credential managed by your organisation's rules, or model access where it applies.
Levee inspects the agent's connection to that site so it can add your sign-in. Programs that only accept one specific server certificate will not work with a connected identity.
Sign-ins are not shared across projects, users or computers.

For your IT team

Whether a user may sign in to a site is decided by policy, in this order:

If webIdentity.enabled is false, connected identities are off entirely.
Otherwise, the first webIdentity.rules entry whose domain matches the site decides (allow or deny).
Otherwise, webIdentity.default decides, if set.
Otherwise, the user may sign in to any site the agent may reach under the web access rules.

{
  "webIdentity": {
    "enabled": true,
    "rules": [
      { "domain": "wiki.example.com", "action": "allow" },
      { "domain": "*.bank.example.com", "action": "deny" }
    ]
  }
}

A refused sign-in is recorded as WebIdentityDenied, and the agent's request fails with the same plain refusal as any other block.

Audit events

Event	When
`WebIdentityEscalated`	The agent reached a site that needed a sign-in, and the user was asked.
`WebIdentityCaptured`	The user signed in and the sign-in was stored.
`WebIdentityDenied`	Policy refused the sign-in, or the user declined.
`WebIdentityRevoked`	The user revoked an identity.
`http.identity.inject`	Levee added a sign-in to one of the agent's requests.

Audit records name the site and count the cookies. Cookie values are never recorded, in the audit trail or in logs.

Approvals Plugins