Versions Compared
Key
- This line was added.
- This line was removed.
- Formatting was changed.
In order for AAD to work, you need to make sure that the following requirements are met.
1: Access to your AAD Azure Account
Access https://portal.azure.com and login.
If you're able to see "Azure Active Directory" - you meet this requirement
Image ModifiedNOTE: Azure Active Directory Group membership syncronization to DC requires Azure Subscription levels "Premium P1" or "Premium P2"
2:
AD and ADFS must be disabledAccess the product or products (DC and or MM) you want to enable AAD login for and verify that you are met with the standard Digizuite login screen (and not ADFS or AD).
If you are not met with a prompt - asking for you to login with AD or ADFS - you meet this requirement and can go ahead with configuring AAD.
3:The ID of a user of which you want all your users to look like (AAD Template User)
Per default the DAM Center is configured with two users, that are "copied" every time either a collection or self-signup user has been created by the system. These two are just users, like any other user. The thing that sets them apart is that their passwords usually is something that's meant never to be written again, and that their member ID's have been set to be called upon by the system.
Usually the self-signup user named "self-sign up template user" has been set up correctly if you already have the self-signup functionality enabled in your Media Manager. If this is the case, usually this user can be used for automatic assigning of roles when creating AAD users. Remember this user's user ID then (usually this is something like "300xx")
Info | |
---|---|
title | InfoIf the group feature is used, the templateUserId is optional, and can be set to 0, as group membership is assigned from AAD Group membership. |
If you don't want to use the previously mentioned template user, you'll have to create a new user. You do this by doing the following steps:Login to your DAM Center with a Super Administrator or an Administrator user
Go to System tools → Users and groups → Users → System users and press Add
In the Username field, you type in "AAD Template User", in the password field you type in something random, and in the Metagroup field "User Config" and press create
- Image Modified
Now make a note about your new user's user ID
- Image Modified
Now edit the user's roles by expanding the right side Edit menu - and then make sure that you're in the view named "Standard" now add the following groups
Internal access
Light user or Content Creator
Public access
Trusted (usually, already added by default)
- Image Modified
Press save
The ID you've noted down will be used in a upcoming section, where you have to edit some XML.
43: Create Groups in Dam Center that reflects Active Directory Groups
Info | |
---|---|
title | NoteThis step requires Azure Subscription level "Premium P1" or "Premium P2", otherwise go to step 5 |
Navigate to System Tools / Groups in Dam Center / Users and groups / Groups.
Create a Folder by right clicking Groups and selecting Add folderImage Removed
Image AddedName the new folder "Azure Active Directory"
Select the new Folder.
In the Azure Portal Navigate to "Azure Active Directory" / "Groups"Image Removed
Image AddedThe Object Id is used to bind the Active Directory Group to a DamCenter Group.
Repeat for each Azure Active Directory group that should grant access to DamCenter
Click "Add", and Give the new DamCenter Group a name.Image Removed
Image AddedImage AddedImage Removed
Click "Create"
Select the new Group, and edit in the right pane.Image Removed
Image AddedFill the "Binding group name" with the object Id from the azure groups "Object Id" field
Check the "Is Binding group" checkbox
Select DamCenter Groups, users that are member of the Azure Group should be member of.
Click Save.
Repeat for each Azure group that should be mapped.
54: Make an App Registration for the DC in the Azure Portal
You have to enable AAD for the DC. All other applications that we support AAD for will inherit it from the DC.
You register your product by doing the following steps:
Access https://portal.azure.com with your Azure credentials, you have from the first requirement (Access to your AAD Azure Account)
Access "Azure Active Directory" (see image)
- Image Modified
In here, press the "App registrations" beneath "Manage" (See image)
- Image Modified
Now press the "New registration"
- Image Modified
In
the "The user-facing display name for this application (this can be changed later)." enter "{dcurl}/DigizuiteCore/LoginService"- In the Redirect URI insert the url again.
- Image Removed Press theImage Removedbutton in the bottom
- Image Removed
- Wing off ID tokens
- Image Removed
- Go to the upper right corner and press your profile card
- Press "Switch Directory"
- Copy the ID on the second line - the one encircled in the image
- Image Removed
- Now go into the app registration. Press Settings, and then Properties
the form, set the “name” to something that is easy to remember and find again should that be needed.
Image Added
Set the “Redirect URI” to “https://{dc-url}/DigizuiteCore/LoginService”On the application page, select “endpoints”
Image AddedFind the “Federation metadata document” url, and save that somewhere convenient. This is the “Metadata address”
Image AddedNext go to “Expose an api”
Image AddedClick Click Application ID URI Set > Save, and then copy the value out and save it. This is the “App id”
Image AddedThe last thing that has to be done, is to invite users to the site. This is described in another guide. In short, access your site's registration in the "Enterprise Applications" tab in the AAD section, and take it from there.
Make a note of the "" - you need this for later
Configuration for Active Directory Group membership syncronization.
Info | |
---|---|
title | InfoThis section is only relevant if Azure Premium P1 or Azure Premium P2 subscription is used. |
Select Manifest in the left pane
Modify the Json document, by modifying the line "groupMembershipClaims": null, to "groupMembershipClaims" : "SecurityGroup",
Image Removed
Image Added
Valid options for groupMembershipClaims are;
"All"
"SecurityGroup"
"DestributionList"
"DirectoryRole"
see: https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-optional-claims
Table of Contents |
---|