Cloud Streaming - SSO - ClassLink SAML 2.0 Setup Guide

• This document is intended to be paired with Cloud Streaming - SSO - SAML Configuration for users with Google Admin Console to manage their users.

You must start an SSO Configuration on your Cloud Portal Admin to continue below. It is best to configure both ends of this SAML handshake together with 2 open windows or tabs on your browser.

Step 1 - Begin ClassLink SAML Application Configuration

1. Go to ClassLink Management Console -> Single Sign-On -> SAML Console.
2. Click ADD NEW
3. Save ClassLink Metadata
4. Copy the IDP Metadata URL from ClassLink
    
   • 

Step 2 - Configure Streaming Server SAML Authentication

1. In a separate tab/window, login to your Swank Streaming portal with your registered Admin account.
2. Select SSO Configuration from the left menu.
3. Review the list of SSO Identity Providers configured for your portal
   1. Legacy Providers:  If you've previously configured SSO via SAML or Google OAuth, you'll find their configuration listed at the bottom here.
      • Note: You cannot "upgrade" your existing SAML configuration to our new Identity Service host - you must create a new SAML configuration.
      • The legacy configurations are deactivated automatically when a new SSO Identity Provider Configuration is activated.  You can "fallback" to the legacy provider by deactivating the new provider(s).
   2. SSO Configuration:  At the top of the page, see the list of available providers.  You can:
      • Activate or Deactivate existing configurations via the Active toggle.
      • Edit or Delete existing configurations via button actions
      • Add new Identity Provider via the button at the Top. 
4. Click Add SSO Configuration
   • 
5. Choose the Provider Type of SAML
   • 
6. Enter a Display Name - This displays on the list of SSO Identity Providers as well as the button added to the Login page. (Suggested: ClassLink)
7. Paste the Metadata URL from step 1.4 in the IdP Metadata Address location on your Portal's SSO Configuration page: 
   • 
8.  Toggle Require Valid Metadata to the off position.
   • 
9. Click the Save button to generate your SAML configuration.
10. Complete the SAML handshake:  
    • These values will be presented for you to copy and enter back into your SAML Identity Provider's configuration. Note: Not all of these values are required by ClassLink.
      • 

Step 3 - Complete ClassLink SAML Application Configuration

1. In your ClassLink SAML App, update the Name, Login URL, and Metadata URL with the Metadata from your Portal's SSO Configuration. You can add any other custom Attribute Mapping and/or Metadata Overrides that are necessary.
   1. Name: Swank Digital Campus or Swank Cloud Streaming is recommended
   2. Metadata URL:
      1. Copy the SP Metadata URL from the SSO configuration on your Swank Streaming Portal
   3. Login URL: Your ClassLink Login URL  
      • (Example URL: https://launchpad.classlink.com/{your_school})
      • Note: "swankschool" is just an example and should be replaced with your actual school identifier. If you are not sure what your ClassLink URL is, you can look up your school here: https://launchpad.classlink.com/
   4. Attributes: Attributes to add:
      • Required:
        • Given Name(First Name) --> given_name
        • Family Name(Last Name) --> family_name
        • User email --> email
      • Optional: Additional attributes are commonly used to differentiate between students and instructors
        • group_names
        • role --> classLink_role
   5. Metadata Overrides: Add the NameID value and use "Email" under the Metadata Overrides section. This will allow the Email to be transmitted as the UserID and allow for easier role mapping on the Swank streaming portal.
   6. Attach LaunchPad app for permission: Leave this box unchecked.
2. Build SSO App - Next, build the SSO app for your users.
   • https://help.classlink.com/s/article/adding-and-assigning-apps
   • From the ClassLink Management Console, go to Add & Assign Apps, click new.
   • Input the name of the SAML app and complete the remaining fields.
   • Turn on Single Sign-On App,
   • Select SAML as the type,
   • Paste the login URL provided by Swank.
     • Example: https://digitalcampus.swankmp.net/[your site ID] or https://streaming.swankmp.net/[your site ID]
   • Click the Assign button and click the Add button(s) for the appropriate groups.

Step 4

Role Mapping, User Authorization, and Permission Elevation

All successful authentications will be authorized at the "Basic" or "User" account levels (role) by default depending on the market. To elevate permissions to a higher permission level for Instructors or Administrators you will need to add Role Mappings to grant this elevation either by Attribute Value or Individual UserID. For more information on Account Level Permissions, please see the following article: 
https://swankmp.zendesk.com/hc/en-us/articles/5723258435092-Cloud-Streaming-User-Account-Roles

There are 3 methods of providing roles and are respected in the following order - with the former values overriding any latter options.

1.  Claim/Attribute of "role" directly provided by your Identity Provider
2.  Role Mapping on the Portal's SSO Configuration
3.  The Portal Default "User" or "Basic" role (Set by your Swank support)

Option 1: Identity Provider Role Assignment (Recommended)

Your Identity Provider can provide a Claim or Attribute for each User with the Name of "role" and the Value of one of our available user roles:  "Admin", "Instructor", "User", or "Basic".  This allows your Identity Provider Admin to set the roles based on policies and rules aligned with your organizations larger technology access strategy and to manage that access centrally at your User Directory.

Each Identity Provider has a different method for handling this action, below are some examples for Google and Azure for reference.

For Google:

1. Go to Users and under More options, choose Manage custom attributes
2. Add a Custom Attribute: Choose any name you'd like for tracking.
3. Assign that Custom Attribute to an App Attribute of "role" in the SAML Attribute mappings.
4. Make sure the User Information in Google Directory populates that Custom Value correctly for each user:

For Azure:

1. Add a User Attribute such as 'SwankRole' that has a Data Type of String
2. Define this string for your users as required
3. In your Azure SAML Configuration, go to the Attributes & Claims and click Add new claim 
   
4. Edit the Name values to role, and map the  Source attribute to the User Attribute created in step 1
   

You can verify you have "Role" attribute provided by checking your diagnostics while logged in under the desired SSO setup.  Log into your Portal's catalog, appending /diagnostics to the URL:  (e.g.: https://digitalcampus.swankmp.net/[your site ID]/diagnostics or https://streaming.swankmp.net/[your site ID]/diagnostics)

 

Option 2: Role Mapping via Attributes

To use this, you will need to identify or create an attribute that defines the user group(s) (such as a department) and differentiates them from the general population (students). Those attributes must be provided to your SSO configuration via your Identity Provider.  You can see what attributes are currently being delivered in your SAML statement via checking your diagnostics.
 

Log into your Portal's catalog, appending /diagnostics to the URL:  (e.g.: https://digitalcampus.swankmp.net/[your site ID]/diagnostics or https://streaming.swankmp.net/[your site ID]/diagnostics)

Under Access Token you will find the available attributes available to role map. 

In this example, you can see the attribute "department" has a value of "adminDepartment". We will use this as an example as to how to grant "Admin" permissions to all users with this attribute value: 

1. While editing the SSO Provider, go to the Claims Role Mappings table, click Add Role Mapping
2. In the Add Role Mapping pop-up window, for this example you would enter:
   Claim Name: "department"
   Claim Value: "adminDepartment"
   Role: "Admin"
    
3. Click Save, You will now see your Role Mappings in the listing
   

You may add as many of these as needed for Instructor and Administrator permissions.   You can see from the example above, you can use direct email addresses, or even these can be based on Groups, such as email groups provided by Google:

Final Step

Make Configuration Active

Once you configured your SAML Identity Provider, and determined your User's roles, remember to click the Activate toggle on the SSO Configuration page for your chosen Provider(s). If you are currently viewing the SSO Configuration detail page, you can click the "Go Back" link at the top of the page or click SSO Configuration from the side menu.

• Toggle Active to the On position for your new SSO Configuration.

•