Skip to main content
Sign in

Cloud Streaming - SSO - Azure OIDC Setup Guide

Andrew Ricke
  • Updated

This document is intended to be paired with Cloud Streaming - SSO - OIDC Configuration for users with Azure Entra ID to manage their users.

 

You must start an SSO Configuration on your Cloud Portal Admin to continue below. It is best to configure both ends of this OIDC handshake together with 2 open windows or tabs on your browser.

 

Step 1 – Start Swank SSO OIDC Configuration

  1. Log Into your Swank Streaming Portal to the Admin section (e.g.: https://digitalcampus.swankmp.net/[your site ID]/admin or https://streaming.swankmp.net/[your site ID]/admin)
  2. Select SSO Configuration in the left menu
  3. Review the list of SSO Configurations for your portal
    •  Legacy Providers:  If you've previously configured SSO via SAML or Google OAuth, you'll find their configuration listed at the bottom here.
      • Note: You cannot "upgrade" your existing OAuth configuration to our new Identity Service host - you must create a new OIDC configuration. 
      • The legacy configurations are deactivated automatically when a new SSO Provider is activated.  You can "fallback" to the legacy provider by deactivating the new provider(s).
    • SSO Configurations:  At the top of the page, see the list of available providers.  You can:
      • Activate or Deactivate existing configurations via the Active toggle.
      • Edit or Delete existing configurations via button actions
      • Add new SSO Configurations via the button at the Top.  (We'll continue this guide from this route)
  4. Click the Add Configuration button. 
    •  
  5. Choose the Provider Type of OIDC
    •  
  6. Display Name: This displays on the list of SSO Configurations as well as the button added to the Login page.

 

Step 2 - Azure App Registration

  1. In a separate tab navigate to your Azure Portal, go to App registrations and click New registration
  2. Complete the Register an application form
    1. Name: Swank Cloud Streaming or Swank Digital Campus is recommended.
    2. Support Account Types: Accounts in this organizational directory only (Default Directory only - Single tenant)
    3. Redirect URL: leave blank for now
    4. Click Register
  3. On the Overview page for this new App, copy the Application (client) ID
     
    • Paste this value into the Client ID of your Swank Streaming Portal's OIDC SSO Configuration
  4. On the Overview page for this new App, click Endpoints
    • Copy the first Authority URL (Accounts in this organizational directory only)
    • Copy this into the Authority URL of your Swank Streaming Portal's OIDC SSO Configuration
  5. On the Overview page for this new App, click the Add a certificate or secret
  6. Click New client secret
    • Select the desired Expires duration - 24 months is recommended
    • Click Add
  7. Copy this newly created client secret.
      • Do not leave this session before copying this Client Secret value or it will no longer be available to use.  Please also note the date of expiration when a new key must be generated.
  8. Paste the Client Secret into the Client Secret of your Swank Streaming Portal's OIDC SSO Configuration
  9. Click Save and a Callback Path (ACS Endpoint) will be generated
  10. Complete the handshake with the OIDC provider by copying the Callback Path (ACS Endpoint)
  11. On your Azure Portal, select Authentication, under Manage
    • Click Add Redirect URI
      • Choose Web
      • Paste the Callback Path (ACS Endpoint) into the Redirect URIs
      • Click Configure
      • Under Authentication > Supported account, make sure it is set to your tenant only.

Step 3 – Update Branding

  1. Navigate to the Manage > Branding & properties page
  2. Add an App Logo - You may use one of the below
  3. Complete the URLs section
  4. Ensure that the Publisher domain is one under your Azure account

 

Step 4 – Add Claims

  1. Navigate to the Manage > Token configuration page
  2. Select Add optional claim, select Token type ID
  3. Claims 
    1. Required
      • email
    2. Optional
      • family_name
      • given_name
  4. Check the box to Turn on Microsoft Graph email if requested.

 

Step 5

Role Mapping, User Authorization, and Permission Elevation

All successful authentications will be authorized at the "Basic" or "User" account levels (role) by default depending on the portal settings. To elevate permissions to a higher permission level for Instructors or Administrators you will need to add Role Mappings to grant this elevation either by Attribute Value or Individual UserID. For more information on Account Level Permissions, please see the following article: 
https://swankmp.zendesk.com/hc/en-us/articles/5723258435092-Cloud-Streaming-User-Account-Roles

 

There are 3 methods of providing roles and are respected in the following order - with the former values overriding any latter options.

  1. Mapping Roles on the Streaming Portal 
  2. Claim/Attribute of "role" directly provided by your Identity Provider
  3. The Portal Default "User" or "Basic" role (Set by your Swank support)

Option 1: Mapping Roles on the Streaming Portal (Recommended)

Initial Account Creation

A registered account with the preferred role using the email of a user can be established prior to their initial login by using one of the methods described in the link below.

 

Post Account Creation

Individual Role Mappings can be modified after an account has been established by using the following steps:

  • Log in to your streaming portal with an Admin account.
  • Select Users from the menu
  • Select the expand menu for the intended user and select Edit Profile
  • Select the appropriate Role and click Save

 

Option 2: Identity Provider Role Assignment

In some cases, your Identity Provider can provide a Claim or Attribute for each User with the Name of "role" and the Value of one of our available user roles:  "Admin", "Instructor", "User", or "Basic".  This allows your Identity Provider Admin to set the roles based on policies and rules aligned with your organizations larger technology access strategy and to manage that access centrally at your User Directory.

Each Identity Provider has a different method for handling this action, please consult your identity provider to confirm the availability and documentation.

Notes: 

  • The attribute name is case-sensitive and must be "role".
  • The attribute values are not case-sensitive.
  • You can verify you have the "Role" attribute provided by checking your diagnostics while logged in under the desired SSO setup.  
    • Log into your Portal's catalog, appending /diagnostics to the URL.
      • For Example:
        • https://digitalcampus.swankmp.net/[your site ID]/diagnostics
        • https://streaming.swankmp.net/[your site ID]/diagnostics)
    • Look for the field Swank.ExternalRole for the role sent by your identity provider (IDP).
  • Once an account is established on your Swank Streaming portal it cannot be overwritten by your IDP role. You can do one of the following:
    • Update the account role manually in the streaming portal.
    • You can attempt to remove the established account, but if it has been used with the title request process this is not always possible.

 

Option 3: Portal Default Role

All successful authentications will be authorized at the "Basic" or "User" account levels (role) by default depending on the portal settings. 

 

 

Final Step

Make Configuration Active

Once you configured your OIDC Identity Provider, and determined your User's roles, remember to click the Activate toggle on the SSO Configuration page for your chosen Provider(s). If you are currently viewing the SSO Configuration detail page, you can click the "Go Back" link at the top of the page or click SSO Configuration from the side menu.

  • Toggle Active to the On position for your new SSO Configuration.

Related articles

Comments

0 comments

Article is closed for comments.

Powered by Zendesk