Skip to main content
Sign in

Cloud Streaming - SSO - Okta SAML 2.0 Setup Guide

Dwaine Webb
  • Updated

 

Step 1 – Begin Okta SAML integration

For detailed information regarding Okta SAML setup within Okta's application, please refer to the guide below. Note: You will only go to the point where a metadata XML file or URL is provided. Once this is provided you can move to step 2 to start the Swank streaming portal configuration.

 

Step 2 - Configure Streaming Server SAML Authentication

  1. In a separate tab/window, login to your Swank Streaming portal with your registered Admin account.
  2. Select SSO Configuration from the left menu.
  3. Review the list of SSO Identity Providers configured for your portal
    • Legacy Providers:  If you've previously configured SSO via SAML or Google OAuth, you'll find their configuration listed at the bottom here.
      • Note: You cannot "upgrade" your existing SAML configuration to our new Identity Service host - you must create a new SAML configuration.
      • The legacy configurations are deactivated automatically when a new SSO Identity Provider Configuration is activated.  You can "fallback" to the legacy provider by deactivating the new provider(s).
    • SSO Configurations:  At the top of the page, see the list of available providers.  You can:
      • Activate or Deactivate existing configurations via the Active toggle.
      • Edit or Delete existing configurations via button actions
      • Add new SSO Identity Providers via the button at the Top.  (We'll continue this guide from this route)
  4. Click Add Configuration
  5. Choose the Provider Type of SAML
  6. Enter a Display Name - This displays on the list of SSO Configurations as well as the button added to the Login page. (Suggested: Okta SAML)
  7. Select Upload SAML Metadata File or enter the IDP Metadata URL from Step 1.
    • Some IDP metadata cannot be validated currently. Toggle Require Valid Metadata to the off position if needed.
  8. Click the Save button to generate your SAML configuration.
  9. Complete the SAML handshake:   
    • These values will be presented for you to copy and enter back into your SAML Identity Provider's configuration.
      • SP EntityID - Required
      • SP Metadata URL - Optional 
      • Callback Path (ACS Endpoint) - Required
    • Once these values are saved at the Identity Provider end, the SAML handshake between your Portal and your Identity Provider should be complete.
    • When copying and pasting this info, make sure there is no trailing "/" or spaces on the G suite side. This will result in errors.  You must include the whole URL including the unique IDs redacted above

Step 3 - Complete Okta Configuration

Please refer to the settings below: 

Single Sign On URL (Portal Specific - see step 2.9)
Recipient URL (Portal Specific - see step 2.9)
Destination URL (Portal Specific - see step 2.9)
Audience Restriction (Portal Specific - see step 2.9)
Default Relay State  
Name ID Format EmailAddress (this may vary for your specific application)
Response Signed
Assertion Signature Signed
Signature Algorithm RSA_SH256
Digest Algorithm SHA256
Assertion Encryption Unencrypted
SAML Single Logout Disabled
authnContextClassRef PasswordProtectedTransport
Honor Force Authentication

Yes

None (Disabled)
SAML Issuer ID http://www.okta.com/$(org.externalKey)

Attribute may vary by application. 

We strongly recommend using the following standardized names for these attributes:

First name > given_name
Last name > family_name
Email > email

 

Step 4 

Role Mapping, User Authorization, and Permission Elevation

All successful authentications will be authorized at the "Basic" or "User" account levels (role) by default depending on the portal settings. To elevate permissions to a higher permission level for Instructors or Administrators you will need to add Role Mappings to grant this elevation either by Attribute Value or Individual UserID. For more information on Account Level Permissions, please see the following article: 
https://swankmp.zendesk.com/hc/en-us/articles/5723258435092-Cloud-Streaming-User-Account-Roles

 

There are 3 methods of providing roles and are respected in the following order - with the former values overriding any latter options.

  1. Mapping Roles on the Streaming Portal 
  2. Claim/Attribute of "role" directly provided by your Identity Provider
  3. The Portal Default "User" or "Basic" role (Set by your Swank support)

Option 1: Mapping Roles on the Streaming Portal (Recommended)

Initial Account Creation

A registered account with the preferred role using the email of a user can be established prior to their initial login by using one of the methods described in the link below.

 

Post Account Creation

Individual Role Mappings can be modified after an account has been established by using the following steps:

  • Log in to your streaming portal with an Admin account.
  • Select Users from the menu
  • Select the expand menu for the intended user and select Edit Profile
  • Select the appropriate Role and click Save

 

Option 2: Identity Provider Role Assignment

In some cases, your Identity Provider can provide a Claim or Attribute for each User with the Name of "role" and the Value of one of our available user roles:  "Admin", "Instructor", "User", or "Basic".  This allows your Identity Provider Admin to set the roles based on policies and rules aligned with your organizations larger technology access strategy and to manage that access centrally at your User Directory.

Each Identity Provider has a different method for handling this action, please consult your identity provider to confirm the availability and documentation.

Notes: 

  • The attribute name is case-sensitive and must be "role".
  • The attribute values are not case-sensitive.
  • You can verify you have the "Role" attribute provided by checking your diagnostics while logged in under the desired SSO setup.  
    • Log into your Portal's catalog, appending /diagnostics to the URL.
      • For Example:
        • https://digitalcampus.swankmp.net/[your site ID]/diagnostics
        • https://streaming.swankmp.net/[your site ID]/diagnostics)
    • Look for the field Swank.ExternalRole for the role sent by your identity provider (IDP).
  • Once an account is established on your Swank Streaming portal it cannot be overwritten by your IDP role. You can do one of the following:
    • Update the account role manually in the streaming portal.
    • You can attempt to remove the established account, but if it has been used with the title request process this is not always possible.

 

Option 3: Portal Default Role

All successful authentications will be authorized at the "Basic" or "User" account levels (role) by default depending on the portal settings. 

 

Related articles

Comments

0 comments

Please sign in to leave a comment.

Powered by Zendesk