Onboarding template - Single Sign-On Integration

Owned by Nicolas Staelens
Last updated: Nov 09, 2022
2 min read

General

Single Sign-On (SSO) is an authentication and authorization process that allows a user to access multiple applications with a single set of login credentials. In case of the customer, this implies that once an employee is successfully authorized, the employee will not need to re-authenticate to access the MediaHaven application. This, in turn, contributes to the ease of use and user experience when accessing MediaHaven.

Single Sign-On is based around the principle of a trust relationship between MediaHaven (as Service Provider/Relying Party) and the Identity Provider (IdP) of the customer. The identity provider offers user authentication as a service and acts on behalf of the customer. This authentication service can then be used by MediaHaven.

This document describes the basic information that needs to be exchanged between Zeticon and the customer in order to set up an SSO integration.

Capabilities of the SSO

When setting up an SSO between MediaHaven and the customer, the SSO will ensure that:

  1. A new user is automatically created in MediaHaven (if the user logs on for the first time and does not yet exist) with the default rights as configured.

  2. The IdP is used for authentication. When a user navigates to MediaHaven, the authentication request will be sent to the IdP of the customer. In this respect, if the user is not authorized, he/she will also not be able to login in MediaHaven.

Based on the information above, it is important that a new user always first authenticates in MediaHaven using the SSO. This way, the user account will automatically be created. In no case should a MediaHaven account be created manually by an admin user.

Once the user account is created in MediaHaven, a MediaHaven administrative user can update rights and permissions for that particular new user account.

Important:

  1. In case an employee leaves the customer, his/her MediaHaven account will not be removed. Due to the SSO, the former employee will not be able to authenticate but the MediaHaven account will still exist. It is up to the customer to decide (and remove) the MediaHaven account manually.

  2. When a MediaHaven account already exists for the user prior to authenticating via the SSO, the authentication attempt will fail. In this case, the MediaHaven account will have to be deleted manually.

Required information to setup the SSO

In order to allow MediaHaven to connect to your IdP, the only information needed is/are the application callback URL(s) that will be used:

https://$HOSTNAME/simplesaml/module.php/saml/sp/saml2-acs.php/$ORGANISATION_NAME

https://$HOSTNAME-QA/simplesaml/module.php/saml/sp/saml2-acs.php/$ORGANISATION_NAME

REPLACE $HOSTNAME and $ORGANISATION_NAME before sending to customer and remove this warning panel

Furthermore, following minimal sets of claims are required to be sent:

Information to be provided to Zeticon

In order for us being able to configure the SSO in MediaHaven, following information needs to be provided:

  • Link to the Federation Metadata XML

  • Test account (username/password) so we can verify the correctness of the SSO after installation

  • App registration Client ID (in case of Azure AD IdP) or Issuer ID (in case of SAML/2 integration)

  • Who to contact in case of technical issues on your side

Answering form

Federation Metadata URL:

 

Test account (username/password):

 

App registration Client ID (Azure AD):
Issuer ID (in case of SAML/2 integration):

 

Technical contact customer side (e-mail + phone):