Kaltura MediaSpace Setup Guide. Version: 4.0

Transcription

1 Kaltura MediaSpace Setup Guide Versin: 4.0

2 Kaltura Business Headquarters 200 Park Avenue Suth, New Yrk, NY , USA Tel.: Cpyright 2012 Kaltura Inc. All Rights Reserved. Designated trademarks and brands are the prperty f their respective wners. Use f this dcument cnstitutes acceptance f the Kaltura Terms f Use and Privacy Plicy.

3 Cntents Preface... 5 Abut this Guide... 5 Audience... 5 Dcument Cnventins... 5 Related Dcumentatin... 6 Sectin 1 Understanding the MediaSpace Setup... 7 Enabling User Permissins Prerequisites... 7 Understanding Cntent Cllectins... 7 Understanding Galleries... 7 Understanding Channels... 8 Understanding Applicatin Rles Mdifying Applicatin Rle Names Assigning Applicatin Rles t Multiple Users in Bulk Understanding Permissins Understanding Rles and Permissins Sectin 2 Setting up MediaSpace Setting Up MediaSpace Cntent in the KMC Uplading MediaSpace Cntent Setting Up MediaSpace Galleries in the KMC Creating MediaSpace Gallery Categries in the KMC Assigning MediaSpace Cntent t Galleries Adding Cntributrs t MediaSpace Galleries Restricting Access t MediaSpace Galleries in the KMC Setting up MediaSpace Channels Defining MediaSpace Channel Types in the KMC Displaying Channels in MediaSpace Setting Permissins fr Creating a MediaSpace Channel Assigning MediaSpace Cntent t Channels Assigning User Permissins t MediaSpace Channels Assigning User Permissins t MediaSpace Channels in the KMC Assigning Managers and Mderatrs t a MediaSpace Channel Listing MediaSpace Channels Assigning User Permissins t a Channel in MediaSpace Setting Up MediaSpace t Run n HTTPS Sectin 3 Authenticating and Authrizing Users Understanding MediaSpace Authenticatin and Authrizatin Scenaris Scenari 1: Authenticatin and Authrizatin Are Managed in Organizatinal Systems Scenari 2: Authenticatin and Authrizatin Are Managed in Kaltura Scenari 3: Authenticatin Is Managed in an Organizatinal System, Authrizatin Is Managed in Kaltura Cnfiguring Authenticatin and Authrizatin fr MediaSpace Enabling Cmmn Lgin Cnfiguratins Kaltura MediaSpace Setup Guide 3

4 Preface Enabling Authenticatin Methds Enabling Authrizatin Methds Setting Up Authenticatin and Authrizatin Cnfiguring LDAP Authenticatin and Authrizatin Cnfiguring SSO Gateway Authenticatin and Authrizatin Cnfiguring Header Authenticatin Cnfiguring Kaltura Authenticatin and Authrizatin Sectin 4 Using MediaSpace withut Entitlement Features Restricting Categries Kaltura MediaSpace Setup Guide 4

5 Preface This preface cntains the fllwing tpics: Abut this Guide Audience Dcument Cnventins Related Dcumentatin Abut this Guide This dcument details the setup required fr Kaltura MediaSpace (KMS) Versin 4.0 fllwing installatin r upgrade. The dcument describes hw t set up yur site structure, preppulate Kaltura MediaSpace cntent, assign user permissins, and implement authenticatin and authrizatin. NOTE: Yu perfrm sme setup steps in the Kaltura MediaSpace Administratin Area and in the Kaltura Management Cnsle (KMC). NOTE: Please refer t the fficial and latest prduct release ntes fr last-minute updates. Technical supprt may be btained directly frm: Kaltura Supprt. Cntact Us: Please send yur dcumentatin-related cmments and feedback r reprt mistakes t knwledge@kaltura.cm. We are cmmitted t imprving ur dcumentatin and yur feedback is imprtant t us. Audience This dcument is intended fr Kaltura MediaSpace site administratrs. Dcument Cnventins Kaltura uses the fllwing admnitins: Nte Wrkflw NOTE: Identifies imprtant infrmatin that cntains helpful suggestins. Kaltura MediaSpace Setup Guide 5

6 Preface Wrkflw: Prvides wrkflw infrmatin. Step 1 Step 2 Related Dcumentatin In additin t this guide, the fllwing prduct dcumentatin is available: Kaltura MediaSpace Kaltura Management Cnsle (KMC) User Manual Kaltura MediaSpace Setup Guide 6

7 Understanding the MediaSpace Setup SECTION 1 Understanding the MediaSpace Setup Kaltura MediaSpace features fine grained gvernance rules that grant specific permissins t cntent n the MediaSpace site. T explain yur ptins, this dcument describes the different site sectins, rles, and permissins that yu can cnfigure fr MediaSpace. This dcument fcuses n setups that include user permissins, referred t as entitlement enabled. T start learning abut MediaSpace, refer t the Kaltura MediaSpace User Manual, which describes channels and user permissins in terms f site features. Enabling User Permissins Prerequisites Cntact yur Kaltura Prject/Accunt Manager t cnfirm that the fllwing prerequisites are implemented: Entitlement services are enabled and enfrce entitlement is set t true in yur accunt settings. (Optinal) The Like feature is enabled in yur accunt settings. A rt categry is set up fr MediaSpace in the KMC (see T set up a MediaSpace categry tree in the KMC) Assigning user permissins usually is handled in bulk using a cmma-separated value (CSV) file. T learn mre abut the End-User Entitlements CSV, refer t the Kaltura Management Cnsle (KMC) User Manual. This guide describes hw t manually assign permissins fr galleries and channels. Understanding Cntent Cllectins Cntent cllectins in MediaSpace are defined as either galleries r channels. Yur MediaSpace instance can include ne r bth. Understanding Galleries Galleries represent structured, centrally curated media galleries that are available frm the MediaSpace tp menu. MediaSpace galleries can be rganized arund specific tpics in either a hierarchal r a flat navigatin layut. When MediaSpace is used as a cmpany/institutin-wide media prtal, galleries usually are shared with the entire rganizatin and als may be available t the public n the web. Understanding Rles and Permissins fr Galleries Yu usually enable permissin t add cntent t galleries using applicatin rles. Fr example, yu enable a user t publish t a gallery by assigning the Admin rle t the user. The rle applies t all galleries. In additin t using rles t enable permissins fr galleries, yu can use entitlement permissins. See Understanding Permissins. Kaltura MediaSpace Setup Guide 7

8 Understanding the MediaSpace Setup Understanding Channels Channels are media cllectins that can be accessed by a subset f users (r all authenticated users). Channels can be created and managed by authrized end-users r can be prvisined centrally by a KMC admin. Understanding Rles and Permissins fr Channels Entitlement permissins are used t assign permissins t channels (fr example, enabling a user t add cntent t a channel). Applicatin Rles apply glbally, while channel permissins are cntextual. An example f cntextual channel permissins is a user with Manager permissins fr ne channel and lwer-level Cntributr permissins fr anther channel. Fr a user t perfrm an actin that a permissin allws, the actin must be allwed by the user's applicatin rle. Therefre, yu must ensure that a user with a permissin f Cntributr r higher (see Understanding Permissins) is assigned a rle f PrivateUplad r higher (see Applicatin Rles). Otherwise, the user is nt able t uplad cntent t MediaSpace despite the permissin that entitles the user t cntribute cntent. A Channel Manager can assign permissins in MediaSpace. The channel manager selects the kind f access that users have fr the channel. If the channel type is restricted r private, the channel manager adds members and assigns member permissins. T learn mre, refer t the Kaltura MediaSpace User Manual. Understanding Channel Types MediaSpace supprts the fllwing types f channels: Open: All authenticated users are entitled t access the channel and cntribute cntent. Restricted: All users are entitled t access the channel, but nly specific users are entitled t cntribute cntent. Private: Only specific users are entitled t access the channel and t cntribute cntent. MediaSpace Terminlgy KMC Prperties Privacy Listing Wh can add cntent? Open Authenticated users N Restrictin N Restrictin Restricted Authenticated users N Restrictin Private Private Authenticated users Private Private Kaltura MediaSpace Setup Guide 8

9 Understanding the MediaSpace Setup Channel type definitins are displayed in MediaSpace under Channel Settings>Basic: KMC entitlement definitins are displayed in the KMC under Cntent>Categries>Edit Categry windw>entitlements tab: NOTE: If mdificatins are made in the KMC that d nt crrespnd t ne f the channel types, MediaSpace behavir will fllw the KMC definitin, nt the designated type. Understanding Channel Listings A cmpany/institutin-wide shared channel listing is available in MediaSpace fr channel searching and cntent discvery. Kaltura MediaSpace Setup Guide 9

10 Understanding the MediaSpace Setup In additin, each user has direct access t the list f all channels they belng t (with permissin f member and abve). T learn mre, refer t the Kaltura MediaSpace User Manual. Understanding Applicatin Rles MediaSpace applicatin rles apply glbally and include: Annymus Can brwse yur site annymusly until trying t access pages/actins that require lgin: My Media, My Playlists, and Add New. Viewer Can brwse public galleries Is nt authrized t uplad new cntent Des nt have a My Media page PrivateUplad Admin Can uplad cntent t My Media Cannt publish t galleries Can add media Can uplad cntent t all galleries Can uplad cntent UnmderatedAdmin Can uplad cntent and bypass mderatin (when mderatin is enabled fr an accunt) MediaSpace applicatin rles are backward cmpatible. Mdifying Applicatin Rle Names Yu can mdify MediaSpace applicatin rle names t match yur institutinal terminlgy. T mdify MediaSpace applicatin rle names On the Cnfiguratin Management panel f the Kaltura MediaSpace Administratin Area, pen the Rles tab. Mdify the label fr ne r mre rles, and click Save. Kaltura MediaSpace Setup Guide 10

11 Understanding the MediaSpace Setup Assigning Applicatin Rles t Multiple Users in Bulk Yu can assign applicatin rles t multiple users with a bulk actin. Yu use an End Users CSV that includes an ptin t assign rles. T uplad an End Users CSV D ne f the fllwing: In the KMC, uplad the End Users CSV. Refer t the Kaltura Management Cnsle (KMC) User Manual. On the User Management panel f the Kaltura MediaSpace Administratin Area: - Click Submit CSV. - Click Chse File t select the CSV file, and click OK. T learn mre abut the End Users CSV, refer t the Kaltura Management Cnsle (KMC) User Manual. Understanding Permissins While an applicatin rle applies t yur entire MediaSpace site (and publishing rights apply t all galleries), sme permissins are gallery- r channel-specific. Yu set user permissins t a specific cntent cllectin by applying the fllwing permissin levels: Member: Can access a channel r gallery but cannt add new cntent Cntributr: Can add cntent t a channel r gallery Mderatr: (Applies t channels nly) In additin t the Cntributr permissin, can mderate cntent. Manager: (Applies t channels nly) In additin t the Cntributr permissin, can mderate channel cntent and access channel settings, including change metadata, edit members, change appearance, and delete channel. See Understanding Rles and Permissins. Kaltura MediaSpace Setup Guide 11

12 Understanding the MediaSpace Setup NOTE: In channels: All permissin levels are relevant fr channels. In galleries: Only the Cntributr and Member permissin levels are relevant t galleries. Assigning a list f users as Members enables the users nly t access a gallery. Assigning a list f users as Cntributrs enables the users t access a gallery and add media. (A user with the Admin applicatin rle als can add media.) Understanding Rles and Permissins Wh can uplad cntent t MediaSpace? A user with an applicatin rle f PrivateUplad and higher (admin, unmderatedadmin) can uplad cntent t MediaSpace. Wh can view galleries? By default, galleries can be accessed by all authrized users. When Annymus mde is enabled, galleries als can be viewed by annymus users. T enable Annymus mde On the Cnfiguratin Management panel f the Kaltura MediaSpace Administratin Area, pen the Auth tab. Under allwannymus, select Yes and click Save. Hw d restricted galleries behave? If a gallery is restricted by entitlement in the KMC s that it is listed and restricts access t Private (members nly), the gallery is displayed in navigatin but unauthrized users cannt access the gallery. If a gallery is restricted by entitlement in the KMC s that it is unlisted and restricts access t Private (members nly), the gallery is displayed in navigatin but unauthrized users have restricted access. Wh can add media t a gallery? The fllwing users can add media t a gallery: A user with an applicatin rle f Admin r UnmderatedAdmin A user wh is assigned Cntributr permissin and abve t a specific gallery Wh can view a channel? The fllwing users can view a channel: A user wh is authrized by entitlement permissins in the KMC A user wh is added as a member by the channel manager in MediaSpace Hw des a user becme a manager? A user can becme a manager in the fllwing ways: Bulk assignment f users t galleries and channels in the KMC. The End-User Entitlements CSV includes fields fr assigning a manager, cntributrs, and member permissins fr each user and channel. An authrized user wh creates a channel is assigned as the channel wner with managerial rights. An wner can add additinal managers, cntributrs, and members t a channel. Hw des a user jin a channel? Kaltura MediaSpace Setup Guide 12

13 Understanding the MediaSpace Setup An end user cannt jin a channel. The sys-admin r channel manager must authrize the user. An authenticated user can access channels that are Open r Restricted. Wh can create a channel? A user with a rle that is defined as a channel creatr can create a channel. Yu define the user rles that can create a channel. See Setting Permissins fr Creating a MediaSpace Channel. Wh can delete a channel? The fllwing are authrized t delete a channel: Frm MediaSpace: The channel wner/manager Frm the KMC: A KMC admin Kaltura MediaSpace Setup Guide 13

14 Setting up MediaSpace SECTION 2 Setting up MediaSpace Setting Up MediaSpace Cntent in the KMC T set up a MediaSpace categry tree in the KMC In the KMC, create a MediaSpace rt categry. a. Select the Cntent tab and then select the Categries tab. b. Click Add Categry. c. On the New Categry windw, select the psitin f the rt categry and save yur new categry. New Categry>Select place in tree d. In the New Categry windw, enter metadata fr the new categry and click Save. New Categry>Enter Details In MediaSpace, define the rt categry. a. On the Cnfiguratin Management panel f the Kaltura MediaSpace Administratin Area, Kaltura MediaSpace Setup Guide 14

15 Setting up MediaSpace pen the Categries tab. b. Under rtcategry, select the categry that yu created, and click Save. 3. In the KMC, verify yur rt categry and sub-categries. a. Select the Cntent tab and then select the Categries tab. b. Verify that the rt categry is displayed with new sub-categries. NOTE: The Archive categry is reserved fr future versins. The Private categry cntains all cntent upladed t the MediaSpace site that has nt been published t galleries and channels. D nt change the Private categry settings. 4. In the KMC, verify that the rt categry is assigned a Privacy Cntext. A Privacy Cntext is defined during MediaSpace installatin r using the KMC. a. In the KMC, select the Cntent tab and then select the Categries tab. b. In the Categries table, click the rt categry name. c. On the Edit Categry windw, select the Entitlements tab. Kaltura MediaSpace Setup Guide 15

16 Setting up MediaSpace d. Under Privacy Cntext Label, cnfirm that a value is displayed. Uplading MediaSpace Cntent T uplad initial cntent fr MediaSpace in the KMC In the KMC, select the Uplad tab and then d ne f the fllwing: Click Uplad frm Desktp. Use this ptin t uplad a small number f files. Under Submit Bulk, select Entries CSV/XML. Use this ptin t uplad a large number f files. Using this ptin, yu als imprt metadata such as categries and tags. T learn mre abut uplading and ingestin, refer t the Kaltura Management Cnsle (KMC) User Manual. Setting Up MediaSpace Galleries in the KMC Creating MediaSpace Gallery Categries in the KMC After yu set up a MediaSpace categry tree, yu can add categries t create galleries r channels. T learn mre abut Creating and Managing Cntent Categries, refer t the Kaltura Management Cnsle (KMC) User Manual. Kaltura MediaSpace Setup Guide 16

17 Setting up MediaSpace T add MediaSpace galleries manually in the KMC 3. In the KMC, select the Cntent tab and then select the Categries tab. Click Add Categry. Add a categry fr a gallery under [MediaSpacert]>Site>Galleries, and save yur new categry. Yu can create up t seven levels f sub-categries. T create MediaSpace galleries in bulk in the KMC In the KMC, select the Uplad tab and, under Submit Bulk, select Categries CSV. Specify the path fr the gallery categries under [MediaSpacert]>Site>Galleries. T specify the rder f MediaSpace gallery categries in the KMC By default, categries in MediaSpace are displayed by creatin date (the mst recent appears last). T mdify the gallery display rder in MediaSpace, yu specify the rder f yur gallery categries in the KMC. In the KMC, select the Cntent tab and then select the Categries tab. Click galleries in the Categries table t pen the Edit Categry windw. Kaltura MediaSpace Setup Guide 17

18 Setting up MediaSpace 3. On the Edit Categry windw, select the Sub Categries tab (displayed nly when there is mre than ne sub-categry): 4. Specify the rder f the sub-categries using the Up and Dwn arrws, and click Save. Repeat fr additinal sub-categry levels under galleries. Assigning MediaSpace Cntent t Galleries After yur gallery structure is set up, yu can assign cntent t yur galleries. Yu can assign entry cntent t categries in the KMC n the Uplad tab's Submit Bulk menu using the Entries CSV/XML ptin. Categries that d nt exist are created when yu submit the file. T display these categries as MediaSpace galleries, specify the [MediaspaceRt]>site>galleries path. T learn mre abut Assigning Cntent t Categries, refer t the Kaltura Management Cnsle (KMC) User Manual. This sectin describes hw t manually assign cntent t galleries. T manually assign cntent t a MediaSpace gallery in the KMC In the KMC, select the Cntent tab and then select the Entries tab. In the Entries table, select ne r mre entries and click Bulk Actins. Kaltura MediaSpace Setup Guide 18

19 Setting up MediaSpace 3. Select Edit Categries and click Add Categries. 4. On the Select Categries windw, under the galleries categry, select ne r mre categries and click Apply: Kaltura MediaSpace Setup Guide 19

20 Setting up MediaSpace In the Entries table, the entries are displayed when yu filter fr a categry t which yu assigned the entries. Als see Assigning MediaSpace Cntent t Channels. T change an entry s MediaSpace cntent wner in the KMC 3. Usually, the user wh uplads cntent in the KMC is nt the administrative cntent wner f the media entry. T change the wner f ne r mre entries: In the KMC, select the Cntent tab and then select the Entries tab. In the Entries table, select ne r mre entries, click Bulk Actins and then select Change Owner. On the Change Owner windw, start typing a new wner name. A list f suggestins is displayed after yu type the third character. 4. On the Change Owner windw, select a user frm the suggestin list and click Save. NOTE: The cntent wner is the user t whm the media is assigned in MediaSpace. Adding Cntributrs t MediaSpace Galleries By default, nly an end user with the Admin applicatin rle can publish media t a gallery. T enable a user t add media t a particular gallery, yu add the user as a Cntributr t a particular categry (under galleries). Kaltura MediaSpace Setup Guide 20

21 Setting up MediaSpace NOTE: Manager and Mderatr permissins are nt relevant fr MediaSpace galleries. Users with these permissins will have nly cntributin rights and will nt be able t administer the gallery in the MediaSpace site. T add a user as a cntributr t a MediaSpace gallery in the KMC NOTE: Yu can add a cntributr t a MediaSpace gallery nly in the KMC In the KMC, select the Cntent tab and then select the Categries tab. In the Categries table, click the categry name. On the Edit Categry windw, select the Entitlements tab. Under Specific End-User Permissins, click Manage. Kaltura MediaSpace Setup Guide 21

22 Setting up MediaSpace 5. On the Specific End-User Permissins windw, click Add User On the Add Users windw, under Permissin Level select Cntributr. On the Add Users windw, under Select End-Users start typing a user name. A list f suggestins is displayed after yu type the third character. 8. On the Add Users windw, select a user frm the suggestin list and click Save. In MediaSpace, the selected user will have the Add Media ptin fr the specified gallery. Restricting Access t MediaSpace Galleries in the KMC T enable nly a specified grup f users t access a MediaSpace gallery Add specific users as members t a gallery categry. See Adding Cntributrs t MediaSpace Galleries. In the KMC, select the Cntent tab and then select the Categries tab. In the Categries table, click the categry name. On the Edit Categry windw, select the Entitlements tab. Kaltura MediaSpace Setup Guide 22

23 Setting up MediaSpace 5. Under Cntent Privacy, select Private and click Save. Yu can further restrict actins by applying rules fr wh can cntribute t the gallery. The categry is displayed in MediaSpace navigatin. When a user wh is nt in the categry s Users List tries t access the categry, an Access Denied message is displayed. NOTE: This methd is different frm the Restricting Categries cnfiguratin fr Using MediaSpace withut Entitlement Features. Setting up MediaSpace Channels Setting up MediaSpace channels in the KMC is similar t setting up galleries (creating categries, assigning cntent). T learn abut what s unique fr channels, see Assigning User Permissins t MediaSpace Channels in the KMC. Defining MediaSpace Channel Types in the KMC Channel managers can define a channel type (Open, Restricted, Private) in MediaSpace. The KMC admin can als define a channel type under Cntent>Categries>Edit Categry windw>entitlements tab. See Understanding Channel Types. Displaying Channels in MediaSpace T add a link t the Channels page and My Channels in the tp MediaSpace navigatin On the Cnfiguratin Management panel f the Kaltura MediaSpace Administratin Area, pen the Navigatin tab. Kaltura MediaSpace Setup Guide 23

24 Setting up MediaSpace Under pre: a. In the type menu, select Channels Page r My Channels. b. In the name field, enter the label t display. 3. Click Save t display the link in the tp MediaSpace navigatin bar. T add a link t My Channels in the header menu 3. On the Cnfiguratin Management panel f the Kaltura MediaSpace Administratin Area, pen the Headermenu tab. Under enabled, select Yes t enable the Headermenu mdule. Under menu: a. In the type menu, select My Channels. b. In the label field, enter the label t display. 4. Click Save t display the link in the MediaSpace header menu. Setting Permissins fr Creating a MediaSpace Channel See Wh can create a channel? T define a user rle that can create a channel On the Cnfiguratin Management panel f the Kaltura MediaSpace Administratin Area, pen the Channels tab. Under channelcreatr, select ne f the fllwing rles, and click Save. Sys Admin Channels can be created nly frm the KMC by the KMC admin user. Viewer All authenticated users privateonly All users with uplad permissins Kaltura MediaSpace Setup Guide 24

25 Setting up MediaSpace admin All users with permissin t uplad and publish t galleries unmderatedadmin All users with permissin t uplad and publish t galleries and t bypass mderatin (if mderatin is enabled) NOTE: We d nt recmmend allwing the Viewer rle t create channels since users with a Viewer rle cannt add cntent t channels they create. When a user has a rle that can create a channel, a Create Channel buttn is displayed n Channel Listing pages. Assigning MediaSpace Cntent t Channels T manually assign cntent t a MediaSpace channel in the KMC In the KMC, select the Cntent tab and then select the Entries tab. In the Entries table, select ne r mre entries and click Bulk Actins. Kaltura MediaSpace Setup Guide 25

26 Setting up MediaSpace 3. Select Edit Categries and click Add Categries. 4. On the Select Categries windw, under the channels categry, select ne r mre categries and click Apply: In the Entries table, the entries are displayed when yu filter fr a categry t which yu assigned the entries. Als see Assigning MediaSpace Cntent t Galleries. Assigning User Permissins t MediaSpace Channels T assign user permissins in bulk, use the End-User Entitlements CSV. T learn mre abut assigning end user permissins, refer t the Kaltura Management Cnsle (KMC) User Manual. T learn mre abut entitlement services and hw they apply t MediaSpace permissins, refer t Intrductin t the Kaltura Entitlement Infrastructure. Assigning User Permissins t MediaSpace Channels in the KMC By default, a channel that yu create in the KMC is restricted t authrized users. Handling permissin restrictins fr channels is similar t the way yu handle permissins fr galleries. See Adding Cntributrs t MediaSpace Galleries. In additin, yu perfrm the fllwing imprtant flws related t channels in the KMC: Assigning Managers and Mderatrs t a MediaSpace Channel Listing MediaSpace Channels Assigning Managers and Mderatrs t a MediaSpace Channel T access channel settings in MediaSpace, a user must have Manager r Mderatr permissins fr the channel. T learn mre abut channel settings, refer t the Kaltura MediaSpace User Manual. T assign a manager t a MediaSpace channel in the KMC In the KMC, select the Cntent tab and then select the Categries tab. Kaltura MediaSpace Setup Guide 26

27 Setting up MediaSpace In the Categries table, click the channel categry name. On the Edit Categry windw, select the Entitlements tab. Under Specific End-User Permissins, click Manage. On the Specific End-User Permissins windw, d ne r mre f the fllwing: In the user list, select ne r mre users and change the user permissin t Manager. Click Add Users. - On the Add Users windw, under Permissin Level select Manager. - On the Add Users windw, under Select End-Users start typing a user name. A list f suggestins is displayed after yu type the third character. - On the Add Users windw, select a user frm the suggestin list and click Save. T assign a mderatr t a MediaSpace channel in the KMC In the KMC, select the Cntent tab and then select the Categries tab. In the Categries table, click the channel categry name. On the Edit Categry windw, select the Entitlements tab. Under Specific End-User Permissins, click Manage. On the Specific End-User Permissins windw, d ne r mre f the fllwing: In the user list, select ne r mre users and change the user permissin t Mderatr. Click Add Users. - On the Add Users windw, under Permissin Level select Mderatr. - On the Add Users windw, under Select End-Users start typing a user name. A list f suggestins is displayed after yu type the third character. - On the Add Users windw, select a user frm the suggestin list and click Save. NOTE: A MediaSpace end user wh creates a channel can assign permissins, including adding managers and mderatrs. Listing MediaSpace Channels In MediaSpace, channels are displayed n the Channels page when there is n restrictin t channel listing in the KMC under Cntent>Categries>Edit Categry windw>entitlements tab. See Understanding Channels. T learn mre abut creating and mderating a channel, refer t the Kaltura MediaSpace User Manual. Kaltura MediaSpace Setup Guide 27

28 Setting up MediaSpace Assigning User Permissins t a Channel in MediaSpace Channel managers and wners can add members and change user permissins in MediaSpace. T edit channel members and permissins in MediaSpace In MediaSpace, n the Channels page r yur My Channels page, click a channel t pen the channel page, and then click Settings. On the Members tab: T mdify the member's permissin level, next t the member's Permissin clumn, click Change, select a new permissin, and click Dne. T remve the member frm channel membership, click Remve. T add a member and assign a permissin level t the new member, click Add Member, enter a user name and select a permissin, and click Add. T learn mre abut editing channel users, refer t the Kaltura MediaSpace User Manual. Setting Up MediaSpace t Run n HTTPS Yu can cnfigure MediaSpace t run n HTTPS. T run MediaSpace n HTTPS D ne f the fllwing: Use HTTPS fr lgin nly. a. On the Cnfiguratin Management panel f the Kaltura MediaSpace Administratin Area, pen the Auth tab. b. Under httpslgin, select Yes and click Save. Kaltura MediaSpace Setup Guide 28

29 Setting up MediaSpace c. On the Cnfiguratin Management panel f the Kaltura MediaSpace Administratin Area, pen the Client tab. d. Under serviceurl, enter an HTTP URL and click Save. Use HTTPS fr yur MediaSpace site. NOTE: T run MediaSpace n HTTPS, cntact yur Kaltura Prject Manager r Accunt Manager fr assistance. D nt attempt t run MediaSpace n HTTPS befre cnsulting yur Kaltura representative. Implement the fllwing prcedure when yur Kaltura representative instructs yu t d s. a. On the Cnfiguratin Management panel f the Kaltura MediaSpace Administratin Area, pen the Auth tab. b. Under httpslgin, select N and click Save. c. On the Cnfiguratin Management panel f the Kaltura MediaSpace Administratin Area, pen the Client tab. d. Under serviceurl, enter an HTTPS URL and click Save. Kaltura MediaSpace Setup Guide 29

30 Authenticating and Authrizing Users SECTION 3 Authenticating and Authrizing Users On the Cnfiguratin Management panel Auth tab f the Kaltura MediaSpace Administratin Area, yu can cnfigure the settings fr the required user authenticatin methd and the required methd fr authrizing a user s access t MediaSpace with a specific Applicatin Rle. The fllwing scenaris are supprted: Scenari 1: Authenticatin and Authrizatin Are Managed in Organizatinal Systems Scenari 2: Authenticatin and Authrizatin Are Managed in Kaltura Scenari 3: Authenticatin Is Managed in an Organizatinal System, Authrizatin Is Managed in Kaltura Usually, bth authenticatin and rle authrizatin are set thrugh integratin with the rganizatinal identity and grup management systems (scenari 1). Kaltura s authenticatin and/r authrizatin ptins may be useful in the cases described in scenaris 2 and 3. NOTE: User authrizatin t channel and cntent entitlements is handled separately. Understanding MediaSpace Authenticatin and Authrizatin Scenaris Scenari 1: Authenticatin and Authrizatin Are Managed in Organizatinal Systems When des this scenari apply? Yu can use yur rganizatinal system as yur MediaSpace identity and rle authrizatin prvider when: Yu have a large-scale MediaSpace deplyment. Yu want all users t lg int MediaSpace with their rganizatinal credentials and t be authenticated by yur centralized authenticatin system. Yu can prvide access frm the MediaSpace applicatin t yur authenticatin and grup management systems. Authrizatin t access MediaSpace with a specific Applicatin Rle derive in mst cases frm user membership in rganizatinal units r grups. Wh can access MediaSpace? Only users wh are authenticated and authrized by yur systems can access MediaSpace. Users wh are nt authenticated by yur systems are denied access t MediaSpace and are nt able t lg in. What user details are stred in Kaltura? The user s identifier, Applicatin Rle, and first and last names (ptinal but recmmended) must be stred in Kaltura. After the user lgs int MediaSpace fr the first time, administratrs can view and manage the user recrd n the User Management panel f the Kaltura MediaSpace Administratin Area. The user s rganizatinal passwrd is nt saved in Kaltura. Kaltura MediaSpace Setup Guide 30

31 Authenticating and Authrizing Users Can yu manually set different user details in Kaltura? Yes, yu can manually set different user details in Kaltura. After the user lgs int MediaSpace fr the first time, administratrs can manage the user recrd n the User Management panel f the Kaltura MediaSpace Administratin Area. An administratr can verride the user details (first and last name) and the user MediaSpace Applicatin Rle. This ptin is useful mainly fr granting a higher- r lwer-level Applicatin Rle t certain users. Fr example, yu can set a Viewer Applicatin Rle t a large grup f peple within yur rganizatin and then manually assign the higher level MediaSpace Admin rle t a few f them. T enable manually verriding settings On the Cnfiguratin Management panel f the Kaltura MediaSpace Administratin Area, pen the Auth tab. Set the fllwing values and click Save. a. Under refreshdetailsonlgin, select N. This ptin is displayed nly when using an external authenticatin prvider. b. Under refreshrleonlgin, select N. This ptin is displayed nly when using an external rle authrizatin prvider. Scenari 2: Authenticatin and Authrizatin Are Managed in Kaltura When des this scenari apply? Yu can use Kaltura as yur MediaSpace identity and rle authrizatin prvider when: Yu want t launch a MediaSpace pilt in yur rganizatin withut IT integratin. Yu want t quickly g live with yur rganizatinal vide prtal befre perfrming IT integratin with yur rganizatinal authenticatin and grup management systems. Only a few users in yur rganizatin need t wrk with MediaSpace, and there is n requirement r need fr managing user authenticatin and credential validatin in yur rganizatinal systems. Yu d nt have a centralized authenticatin system r yu are nt able t prvide access t yur authenticatin system frm the MediaSpace applicatin. Wh can access MediaSpace? Only users with a MediaSpace user accunt pre-prvisined in Kaltura can access MediaSpace. (The user accunt must include a MediaSpace Rle and a MediaSpace passwrd.) If yu want t revke MediaSpace access frm a specific user, it is yur respnsibility t delete the user accunt in ne f the fllwing ways: On the User Management panel f the Kaltura MediaSpace Administratin area, select ne r mre users, and click Delete r Delete Checked. Submit a Kaltura end-users CSV t delete MediaSpace user accunts in bulk. T learn mre, see the submit a Kaltura end-users CSV prcedure step. Use the Kaltura API t: Delete the user recrd. Remve the user's MediaSpace Rle stred in a custm data prfile. Kaltura MediaSpace Setup Guide 31

32 Authenticating and Authrizing Users Hw d yu switch frm Kaltura-managed authenticatin and authrizatin t managing MediaSpace authenticatin and authrizatin in yur system? Fllwing the cmpletin f yur pilt, r when the IT integratin with yur user authenticatin and grup management systems is cmpleted, n the Cnfiguratin Management panel f the Kaltura MediaSpace Administratin Area, pen the Auth tab and change the selected authenticatin/authrizatin methd. In the Kaltura MediaSpace Administratin Area, yu may verride the Kaltura-managed Applicatin Rles frm yur system n the Cnfiguratin Management panel r by manually deleting existing MediaSpace user accunts n the User Management panel. T verride Kaltura-managed Applicatin Rles n the Cnfiguratin Management panel On the Cnfiguratin Management panel f the Kaltura MediaSpace Administratin Area, pen the Auth tab. Set the fllwing values and click Save. a. Under refreshdetailsonlgin, select Yes. This ptin is displayed nly when using an external authenticatin prvider. b. Under refreshrleonlgin, select Yes. This ptin is displayed nly when using an external rle authrizatin prvider. Scenari 3: Authenticatin Is Managed in an Organizatinal System, Authrizatin Is Managed in Kaltura When des this scenari apply? Yu can use Kaltura as yur MediaSpace access and rle authrizatin prvider when: Yu have a small- t large-scale MediaSpace deplyment. Yu want all users t lg int MediaSpace with their rganizatinal credentials and t be authenticated by yur centralized authenticatin system. Authrizatin fr users t access MediaSpace and MediaSpace Applicatin Rles is independent f their membership in rganizatinal units r grups. Fr example, users wh will be granted MediaSpace access d nt belng t a specific rganizatinal unit r grup. Yu are nt able t prvide access t yur grup management system frm the MediaSpace applicatin fr setting grup-based rle authrizatin. Yu want t set users' applicatin rles befre their first lgin t MediaSpace. Wh can access MediaSpace? Only users wh are authenticated by yur systems and have MediaSpace user accunts pre-prvisined in Kaltura (the user accunt includes MediaSpace Applicatin Rles) can access MediaSpace. Users wh are nt authenticated by yur systems are denied access t MediaSpace, even if they are have a user accunt and a MediaSpace Applicatin Rle in Kaltura. These unauthenticated users will nt be able t lg in. Kaltura MediaSpace Setup Guide 32

33 Authenticating and Authrizing Users Cnfiguring Authenticatin and Authrizatin fr MediaSpace Enabling Cmmn Lgin Cnfiguratins On the Cnfiguratin Management panel Auth tab f the Kaltura MediaSpace Administratin Area, the fllwing MediaSpace lgin ptins are available fr all authenticatin and authrizatin methds. Enabling Authenticatin Methds On the Cnfiguratin Management panel Auth tab f the Kaltura MediaSpace Administratin Area, the fllwing authenticatin methds are supprted as part f the MediaSpace standard installatin. When yu select an authenticatin adapter, a set f relevant cnfiguratin fields is displayed t fill in. LDAP Authenticatin User authenticatin and credentials validatin thrugh direct access t the rganizatinal LDAP r Active Directry server. SSO Gateway Authenticatin A Kaltura generic gateway fr integrating with a custmer- specific lgin and authenticatin implementatin, while prviding the user with a Single Sign-On experience. Header Authenticatin User is authenticated thrugh a request in the rganizatinal authenticatin system. The respnse includes the authenticated user ID in a specific HTTP header. Kaltura Authenticatin Manage MediaSpace users and their authenticatin in Kaltura. Custm Authenticatin Methds Fr any ther type f authenticatin methd, custm adapters can be develped and added t the MediaSpace installatin. Enabling Authrizatin Methds On the Cnfiguratin Management panel Auth tab f the Kaltura MediaSpace Administratin Area, the Kaltura MediaSpace Setup Guide 33

34 Authenticating and Authrizing Users fllwing authrizatin methds are supprted as part f the MediaSpace standard installatin. When yu select an authrizatin methd, a set f relevant cnfiguratin fields is displayed t fill in. LDAP Authrizatin The user s applicatin rle in MediaSpace is determined based n rganizatinal grups in which the user is a member, which are managed in the rganizatin s LDAP server. This authrizatin methd usually is used tgether with the LDAP authenticatin methd. The methd als can be selected when using ther authenticatin methds (SSO Gateway authenticatin, Kaltura authenticatin, and Header authenticatin). SSO Gateway Authrizatin - The user s applicatin rle in MediaSpace is set and passed t MediaSpace as part f the custmer-specific lgin and authenticatin implementatin, which is set thrugh the Kaltura SSO gateway interface. Always use this ptin with SSO Gateway authenticatin. This ptin cannt be used with any authenticatin methd besides SSO Gateway authenticatin. Kaltura Authrizatin Manage user authrizatin t access MediaSpace and user MediaSpace applicatin rles in Kaltura. This authrizatin ptin can be used with any ther authenticatin methd (SSO Gateway authenticatin, Kaltura authenticatin, and Header authenticatin). Custm Authenticatin Methds Fr any ther type f access and rle authrizatin methd, custm adapters can be develped and added t the MediaSpace installatin. Setting Up Authenticatin and Authrizatin Cnfiguring LDAP Authenticatin and Authrizatin T learn mre abut integrating yur LDAP server fr authenticating users and authrizing user access t MediaSpace with a specific applicatin rle, refer t Kaltura MediaSpace Intrductin t Authenticatin and Authrizatin Slutins and Kaltura MediaSpace LDAP Integratin Guide. T cnfigure user authenticatin thrugh yur LDAP server On the Cnfiguratin Management panel f the Kaltura MediaSpace Administratin Area, pen the Auth tab. After yu cmplete and verify the fllwing steps, click Save. Under authnadapter, select LDAP AuthN. 3. Select yur preferences fr the cmmn lgin ptins. Kaltura MediaSpace Setup Guide 34

35 Authenticating and Authrizing Users 4. Under refreshdetailsonlgin, select yur preference. This ptin affects the updating f the user s first name, last name, and address (when prvided) frm yur LDAP system upn every lgin. 5. Under ldapserver: a. Select the LDAP Server access and bind settings. Yur bindmethd selectin will affect the infrmatin yu need t prvide fr authenticating the user. LDAP Server Cnfiguratin bindmethd selectin LDAP Server Cnfiguratin - Direct Bind ptins Kaltura MediaSpace Setup Guide 35

36 Authenticating and Authrizing Users LDAP Server Cnfiguratin - Search befre Bind ptins b. Select the LDAP attributes fr first name, last name and address. Ppulating the user s first and last name is used fr several MediaSpace ptins that require the user name. The address is ptinal. This field is useful fr user management and fr future features (such as ntificatins). 6. LDAP Server Cnfiguratin - ptins If yu are using yur LDAP server t authrize user access t MediaSpace with a specific applicatin rle, cntinue with the next prcedure. If nt, select a different authrizatin methd. T cnfigure user authrizatin thrugh yur LDAP server On the Cnfiguratin Management panel f the Kaltura MediaSpace Administratin Area, pen the Auth tab. After yu cmplete and verify the fllwing steps, click Save. Under authzadapter, select LDAP AuthZ. Kaltura MediaSpace Setup Guide 36

37 Authenticating and Authrizing Users 3. Under refreshrleonlgin, select yur preference. This ptin affects the updating f the user s rle frm yur LDAP system upn every lgin. 4. Under ldapoptins, select yur preferences fr getting the list f grups in which the user is a member. This ptin is used t determine the user's MediaSpace Applicatin Rle. Under grupsmatchingorder, enter the rder fr matching MediaSpace rles t LDAP grups. The rder determines whether the strngest r weakest rle is mapped first. Yur grupsearch selectin will affect the infrmatin yu need t prvide. LDAP Authrizatin Optins - Get Grups frm User Kaltura MediaSpace Setup Guide 37

38 Authenticating and Authrizing Users 5. LDAP Authrizatin Optins - Get User frm Grups Under ldapgrups, select yur preferences t define the mappings between the grups defined in yur LDAP server and the MediaSpace Applicatin Rles. Cnfiguring SSO Gateway Authenticatin and Authrizatin T learn mre abut integrating MediaSpace with yur authenticatin systems using the MediaSpace SSO Gateway, refer t Kaltura MediaSpace Intrductin t Authenticatin and Authrizatin Slutins Kaltura MediaSpace Setup Guide 38

39 Authenticating and Authrizing Users and Kaltura MediaSpace SSO Integratin Guide. T cnfigure user authenticatin using the MediaSpace SSO gateway On the Cnfiguratin Management panel f the Kaltura MediaSpace Administratin Area, pen the Auth tab. After yu cmplete and verify the fllwing steps, click Save. Under authnadapter, select SSO Gateway AuthN Select yur preferences fr the cmmn lgin ptins. Under refreshdetailsonlgin, select yur preference. This ptin affects the updating f the user s first name, last name and address (when prvided) frm yur authenticatin system upn every lgin. 5. Under ss, select yur preferences fr integrating the MediaSpace SSO Gateway with yur lgin implementatin: secret Enter the secret string shared with the lgin page. The default value uses yur Kaltura Admin Secret (accessible frm KMC -> Settings -> Integratin Settings). lginurl Enter the abslute URL where yu hst the lgin page. lguturl Enter the URL t which MediaSpace redirects a user after invalidating the lcal MediaSpace sessin (fr example, when a user clicks lgut). - On yur site yu may use this page t invalidate ther authenticated sessins, if needed (fr example, CAS lgin). - A sessinkey URL parameter is autmatically appended t the lgut URL. This parameter securely encapsulates the user infrmatin, enabling yu t knw which user lgged ut. The sessinkey parameter is cnstructed using the secret shared with the lgin page. 6. If yu are using the MediaSpace SSO Gateway t authrize user access t MediaSpace with a specific applicatin rle, cntinue with the next prcedure. T cnfigure user authrizatin using the MediaSpace SSO gateway On the Cnfiguratin Management panel f the Kaltura MediaSpace Administratin Area, pen the Auth tab. Kaltura MediaSpace Setup Guide 39

40 Authenticating and Authrizing Users After yu cmplete and verify the fllwing steps, click Save. Under authzadapter, select SSO Gateway AuthZ. 3. Under refreshrleonlgin, select yur preference. This ptin affects the updating f the user s rle upn every lgin. Cnfiguring Header Authenticatin T cnfigure header authenticatin thrugh the MediaSpace SSO gateway On the Cnfiguratin Management panel f the Kaltura MediaSpace Administratin Area, pen the Auth tab. After yu cmplete and verify the fllwing steps, click Save. Under authnadapter, select Header AuthN Select yur preferences fr the cmmn lgin ptins. Under refreshdetailsonlgin, select yur preference. This ptin affects the updating f the user s first name, last name, and address (when prvided) frm yur authenticatin system upn every lgin. Kaltura MediaSpace Setup Guide 40

41 Authenticating and Authrizing Users 5. Under headerauth, enter values fr: headername the ID f the authenticated user lguturl Cnfiguring Kaltura Authenticatin and Authrizatin Authenticating r authrizing MediaSpace users in Kaltura requires creating MediaSpace user accunts that include a MediaSpace Applicatin Rle. Only users with a MediaSpace user accunt and MediaSpace Applicatin Rle are able t lg int MediaSpace. Authenticating MediaSpace users in Kaltura als requires setting a passwrd fr each MediaSpace user. Fllw the prcedure t create MediaSpace user accunts that include a MediaSpace Applicatin Rle. T cnfigure Kaltura authenticatin On the Cnfiguratin Management panel f the Kaltura MediaSpace Administratin Area, pen the Auth tab. After yu cmplete and verify the fllwing steps, click Save. Under authnadapter, select Kms_Auth AuthN. 3. Select yur preferences fr the cmmn lgin ptins. T cnfigure Kaltura authrizatin On the Cnfiguratin Management panel f the Kaltura MediaSpace Administratin Area, pen the Auth tab. Under authzadapter, select Kms_Auth AuthZ and click Save. Kaltura MediaSpace Setup Guide 41

42 Authenticating and Authrizing Users T create MediaSpace user accunts that include a MediaSpace Applicatin Rle D ne f the fllwing: On the User Management panel f the Kaltura MediaSpace Administratin Area, yu can create and manage MediaSpace user accunts. Use the list t manually manage all users in the partner accunt that have a MediaSpace rle fr the specific MediaSpace instance. Submit a Kaltura end-users CSV t create MediaSpace user accunts in bulk. Use the fllwing frmat: T learn mre abut the end-user CSV schema, refer t End-Users CSV Usage and Schema Descriptin. The userid field must include a minimum f three characters. The MediaSpace Applicatin Rle is managed within the MediaSpace user metadata schema. Adjust the schema name in the example t include yur MediaSpace instanceid. (Yu can cpy the MediaSpace instanceid frm the Cnfiguratin Management panel Applicatin tab f the Kaltura MediaSpace Administratin Area.) Set the rle names in the CSV accrding t the rle labels yu set in the Cnfiguratin Management panel Rles tab f the Kaltura MediaSpace Administratin Area. When using Kaltura t authenticate users, yu may ppulate a sha1 hashed passwrd in the CSV as part f the partnerdata field, as in the example. MediaSpace administratrs are respnsible fr managing passwrd hashing and distributin t users. The un-hashed passwrd must include a minimum f six characters. When using Kaltura nly fr authrizing user access t MediaSpace with a specific applicatin rle, d nt ppulate the passwrd in the CSV. (Yu can remve the partnerdata clumn in the example frm the CSV since it is nt required.) Kaltura MediaSpace Setup Guide 42

43 Authenticating and Authrizing Users Yu can submit the end-users CSV in the fllwing ways: - On the User Management panel f the Kaltura MediaSpace Administratin Area, click Submit CSV. - In the KMC, select the Uplad tab and then under Submit Bulk, select End-Users CSV. T autmate the update f the authrized MediaSpace users list When yu manage MediaSpace authrizatin in Kaltura, yu can develp autmated prcesses fr updating the list f MediaSpace users based n changes in yur rganizatinal infrmatin system. Yu can develp a scheduled update prcess t peridically add r delete multiple users t the MediaSpace users list using the Kaltura end-users CSV. In yur script, yu can call the user.addfrmbulkuplad Kaltura API actin t submit the CSV. Using Kaltura API actins, yu can develp a trigger-based prcess t update the MediaSpace users list in real time when changes ccur in yur rganizatinal infrmatin system. Yu can call the user.add, user.delete and user.update Kaltura API actins t add, delete, and update specific user recrds. Yu can call the metadata.add, metadata.delete, and metadata.update Kaltura API actins t add, delete, and update the user's MediaSpace rle. NOTE: Deleted users are als remved frm all channels in which they are members. Cntent wnership and analytics infrmatin f the deleted user are nt deleted. NOTE: Since user recrds are shared by all Kaltura applicatins running n the same accunt, we recmmend that yu delete recrds nly f users wh left the rganizatin. In ther cases, we recmmend revking the user's access t MediaSpace by using the Kaltura API t remve nly the user's MediaSpace rle r by using the User Management panel f the Kaltura MediaSpace Administratin Area t delete the user. Kaltura MediaSpace Setup Guide 43