Integrating YuJa Enterprise Video Platform with LDAP / Active Directory

Transcription

1 Integrating YuJa Enterprise Video Platform with LDAP / Active Directory

2 1. Overview This document is intended to guide users on how to integrate Single Sign-On (SSO) capabilities using LDAP/Active Directory in their YuJa Enterprise Video. Once configured, users will be able to authenticate via their LDAP credentials to log into YuJa. 2. Setup Setup involves providing YuJa with the configuration parameters from your LDAP server, then testing and creating a new SSO system for your institution's domain. Once successfully tested, activating the new LDAP system will make it available for all users of your institution. NOTE: For some steps, <institution> is to be replaced by the wildcard DNS of the institution associated with YuJa. As an example, for <institution> would be replaced by hudson. 2.1 Creating a New LDAP SSO System in YuJa 1. Navigate to your institution s YuJa domain (i.e Login as an IT Manager. 3. In the Main Menu located in the top right corner, go to the Admin Panel tab. 4. In the left sidebar, go to Integrations.

3 5. Under Select an API to configure, select SSO - LDAP. 6. Enter the following configuration settings: Section Parameter Description Exampl e LDAP URL The LDAP URL. YuJa will use this URL to access your sever. Ldaps:// Access Credentials Anonymous Login If allowed, YuJa will not need credentials to access the LDAP URL. N/A Manager DN Manager PW The credentials of an LDAP user which YuJa can use to access the LDAP URL. cn=yujamanager,ou=users,dc=example,dc=com **The password of the LDAP user** Base User DN The container which YuJa should search for groups. ou=users,dc=example,dc=com Username The user property describing their username. samaccountname User Requirements Disable Username Filter If checked, the username filter (usernameattr=loginusername) will not be applied and only the Other s Filter will be used. N/A Other s Filters Other properties that users must have. Leave empty for no additional filters. (& (objectclass=user) (sn=*)) Filter By Groups If checked, LDAP access to users will be limited in certain groups. N/A Group Requirements Base Group DN Allowed Groups The container which YuJa should search for groups. Set of white-listed groups, comma separated. ou=groups,dc=example,dc=com cn=math, cn=software Group Membership The user property describing group membership. memberof Given Name The user property describing the user's given name. givenname Family Name The user property describing the user's family name. sn User Provisioning Address The user property describing the user's . mail Instructor Filter If a user matches this filter, they will be provisioned as an Instructor. (& (objectclass=user) (sn=*)) IT Manager Filter If a user matches this filter, they will be provisioned as an IT Manager. (& (objectclass=user) (sn=*))

4 7. Enter the user credentials of any LDAP enabled account within your institution. 8. Click Test and Create. In the confirmation dialog, click OK. If successful, you will be able to see a list of Validated User s. 9. If required, you can update the configuration settings if you made a mistake. Simply click Test and Save to keep the changes. 10. Once you have verified that the LDAP SSO works, you can choose to activate the new authentication scheme for your institution. To do so, click Activate, then click OK. IMPORTANT: Only activate the new authentication scheme after successfully performing a test login and are ready to make it available for all users in your institution.

5 2.2 Dual Integration with LTI Overview If your institution has enabled both LMS Integration via LTI and also LDAP SSO access, then you have the choice to link the two integrations. We generally recommend this because it mean that irrespective of whether your users login via their LMS or their SSO, they will be presented with the same YuJa account information. In contrast, if Dual Integration with LTI is not setup, a user who uses both their LMS and SSO with YuJa will be provisioned with two separate accounts which in many cases isn t ideal. How It Works If your institution has enabled both LTI and LDAP SSO access, then you have the choice to link the two integrations. By default, a user logging in via both LTI and LDAP receives a separate YuJa account for each login. If your LTI provider is configured to authenticate users via their LDAP credentials, it is possible to link the two accounts as the LTI provider will give YuJa a unique identifier for the user in the LDAP system. 1. Configure your LMS to pass a custom LTI parameter to the YuJa tool called lis_person_sourcedid which contains the cross-matching SSO value. This can be an , employee ID, or other field. You may need to consult your LMS platform s product documentation on how to set custom LTI parameters. YuJa will make use of this feature to link the two login methods to the same account. 2. Enter the LDAP user property that maps to the LTI external identifier (in Step 1 above). into the Linkage field. 3. Note: This textbox will only appear if your institution has enabled LTI access. Click Test and Save to keep the changes. 4. Now, when logging in for the first time via LDAP, the YuJa system will search for a link with an LTI account using the value of the linkage attribute. If found, the LDAP account will be linked to the existing account. Otherwise, a new account will be provisioned as normal. All logins past the first one will continue to link to the YuJa account created or found on the first login.

6 3. Usage Once YuJa has been configured and the LDAP SSO system has been activated, it is easy to test and see if everything was done properly. 1. Go to the institution s YuJa domain (i.e. and press Login. 2. Enter valid LDAP credentials and sign in. 3. Once authenticated, the user should be redirected back to YuJa and the login was a success.