Cloud Streaming - SSO - SAML Configuration – Swank Motion Pictures, Inc.

This guide will walk through the steps required for the new Authentication process released in Q1 of 2025 to a limited test group. This will be available to all customers in the near future. This new process is aimed at providing an easier configuration for SSO, with easier management of users, roles, and SSO options.

Some new features include:

More than one SSO Identity Provider may be configured and activated at a time.
A SSO configuration may be used on more than a single portal at a time.
1. For districts who may leverage multiple portals per school or class level.
2. For universities who may leverage multiple Swank products for different audiences.
Both SAML v2.0 and ODIC / OAuth 2.0 are supported. Deprecated is the Legacy Google OAuth.

Step 1 – Configure SAML Application in your IDP

Choose the guide below to see examples of how to configure your IDP. If your IDP is not listed, please review the Okta guide as it tends to be the most helpful for less common applications.

(Note: This new SAML configuration will now support multiple portals with a single configuration. If you'd like an additional portal with the same configuration setup, please contact support. This action cannot be done via the UI. However, we recommend adding additional portals as additional "Applications" within your IDP whenever possible for the best tailored experience.)

You must start an IDP configuration to continue below. It is best to configure both ends of this SAML handshake together with 2 open windows or tabs on your browser.

Step 2 – Configure SAML Authentication

Log Into your Portal to the Admin section (e.g.: https://digitalcampus.swankmp.net/[your site ID]/admin or https://streaming.swankmp.net/[your site ID]/admin)
Select SSO Configuration in the left menu
Review the list of SSO Configuration Providers for your portal
1. Legacy Providers: If you've previously configured SSO via SAML or Google OAuth, you'll find their configuration listed at the bottom here.
  - Note: You cannot "upgrade" your existing SAML configuration to our new Identity Service host - you must create a new SAML configuration.
  - The legacy configurations are deactivated automatically when a new SSO Identity Provider is activated. You can "fallback" to the legacy provider by deactivating the new provider(s).
2. SSO Providers: At the top of the page, see the list of available providers. You can:
  - Activate or Deactivate existing configurations via the Active toggle.
  - Edit or Delete existing configurations via button actions
  - Add new SSO Providers via the button at the Top. (We'll continue this guide from this route)
Click the Add Configuration button.
Choose the Provider Type of SAML
Enter a Display Name - This displays on the list of SSO Configurations as well as the button added to the Login page.
Complete the IdP Metadata via the method given by your Identity Provider when setting up a SAML connection on their end.
- Preferred (Azure, Classlink): Provide the URL of a valid metadata XML file hosted by your provider.
- Alternative (Google): Upload the Metadata XML file copied or downloaded from your provider.
Validate Metadata: Click to verify accuracy of the metadata aligns with expectations.
- Some Providers may not validate, yet still work. You may toggle off the Require Valid Metadata in these cases to allow
Optional - Add a Certificate: If your provider requires a certificate, you may upload it here. This will provide additional security functionality, allowing additional encryption features. This may also require adding an additional password from your Identity provider.
1. Upload the certificate file
2. Validate Certificate once uploaded
3. If the Certificate requires a password, you will be asked to provide it. (Google calls this the SHA-256 fingerprint., Azure the Thumbprint)
Click the Save button to generate your SAML configuration.
Complete the SAML handshake:
- These values will be presented for you to copy and enter back into your SAML Identity Provider's configuration.
  - SP EntityID - Required
  - SP Metadata URL - Optional (Google does not support)
  - Callback Path (ACS Endpoint) - Required
  - Signed Out Callback Path (SLO Endpoint) - Optional (Google does not support)
- Once these values are saved at the Identity Provider end, this SAML handshake between your Portal and your Identity Provider should be complete.

Step 3

Role Mapping, User Authorization, and Permission Elevation

All successful authentications will be authorized at the "Basic" or "User" account levels (role) by default depending on the portal settings. To elevate permissions to a higher permission level for Instructors or Administrators you will need to add Role Mappings to grant this elevation either by Attribute Value or Individual UserID. For more information on Account Level Permissions, please see the following article:
https://swankmp.zendesk.com/hc/en-us/articles/5723258435092-Cloud-Streaming-User-Account-Roles

There are 3 methods of providing roles and are respected in the following order - with the former values overriding any latter options.

Mapping Roles on the Streaming Portal
Claim/Attribute of "role" directly provided by your Identity Provider
The Portal Default "User" or "Basic" role (Set by your Swank support)

Option 1: Mapping Roles on the Streaming Portal (Recommended)

Initial Account Creation

A registered account with the preferred role using the email of a user can be established prior to their initial login by using one of the methods described in the link below.

Cloud Streaming - Registered Accounts – Swank Motion Pictures, Inc.

Post Account Creation

Individual Role Mappings can be modified after an account has been established by using the following steps:

Log in to your streaming portal with an Admin account.
Select Users from the menu
Select the expand menu for the intended user and select Edit Profile
Select the appropriate Role and click Save

Option 2: Identity Provider Role Assignment

In some cases, your Identity Provider can provide a Claim or Attribute for each User with the Name of "role" and the Value of one of our available user roles: "Admin", "Instructor", "User", or "Basic". This allows your Identity Provider Admin to set the roles based on policies and rules aligned with your organizations larger technology access strategy and to manage that access centrally at your User Directory.

Each Identity Provider has a different method for handling this action, please consult your identity provider to confirm the availability and documentation.

Notes:

The attribute name is case-sensitive and must be "role".
The attribute values are not case-sensitive.
You can verify you have the "Role" attribute provided by checking your diagnostics while logged in under the desired SSO setup.
- Log into your Portal's catalog, appending /diagnostics to the URL.
  - For Example:
    - https://digitalcampus.swankmp.net/[your site ID]/diagnostics
    - https://streaming.swankmp.net/[your site ID]/diagnostics)
- Look for the field Swank.ExternalRole for the role sent by your identity provider (IDP).
Once an account is established on your Swank Streaming portal it cannot be overwritten by your IDP role. You can do one of the following:
- Update the account role manually in the streaming portal.
- You can attempt to remove the established account, but if it has been used with the title request process this is not always possible.

Option 3: Portal Default Role

All successful authentications will be authorized at the "Basic" or "User" account levels (role) by default depending on the portal settings.

Final Step

Make Configuration Active

Once you configured your SAML Identity Provider, and determined your User's roles, remember to click the Activate toggle on the SSO Configuration page for your chosen Provider(s). If you are currently viewing the SSO Configuration detail page, you can click the "Go Back" link at the top of the page or click SSO Configuration from the side menu.

Toggle Active to the On position for your new SSO Configuration.