Kaltura MediaSpace Setup Guide. Version: 5.0

Transcription

1 Kaltura MediaSpace Setup Guide Versin: 5.0

2 Kaltura Business Headquarters 5 Unin Square West, Suite 602, New Yrk, NY, 10003, USA Tel.: Cpyright 2013 Kaltura Inc. All Rights Reserved. Designated trademarks and brands are the prperty f their respective wners. Use f this dcument cnstitutes acceptance f the Kaltura Terms f Use and Privacy Plicy.

3 Cntents Preface... 6 Abut this Guide... 6 Audience... 6 Dcument Cnventins... 6 Related Dcumentatin... 7 Sectin 1 Understanding the MediaSpace Setup... 8 Enabling User Permissins Prerequisites... 8 Understanding Cntent Cllectins... 8 Understanding Categries... 8 Understanding Channels... 8 Categries vs. Channels... 9 Understanding Rles and Permissins fr Categries and Channels... 9 Understanding Applicatin Rles Mdifying Applicatin Rle Names Assigning Applicatin Rles t Multiple Users in Bulk Understanding Entitlement Permissins Understanding Rles and Permissins Sectin 2 Setting up MediaSpace Setting up MediaSpace Cntent in the KMC Uplading MediaSpace Cntent Setting up MediaSpace Categries in the KMC Adding Cntent t yur MediaSpace Categries Adding Members and Cntributrs via the KMC Setting up MediaSpace Channels Displaying Channels in MediaSpace Setting Permissins fr Creating a MediaSpace Channel Assigning MediaSpace Cntent t Channels Assigning User Permissins t MediaSpace Channels Assigning User Permissins t MediaSpace Channels in the KMC Assigning Managers t a MediaSpace Channel Assigning User Permissins t a Channel in MediaSpace Setting up MediaSpace t Run n HTTPS Sectin 3 Authenticating and Authrizing Users in MediaSpace Scenari 1: Authenticatin and Authrizatin Are Managed in Organizatinal Systems Scenari 2: Authenticatin and Authrizatin are Managed by Kaltura Scenari 3: Authenticatin is Managed in an Organizatinal System, Authrizatin is Managed by Kaltura Enabling Cmmn Lgin Cnfiguratins Enabling Authenticatin Methds Enabling Authrizatin Methds Kaltura MediaSpace Setup Guide 3

4 Cntents Cnfiguring LDAP Authenticatin and Authrizatin Cnfiguring SSO Gateway Authenticatin and Authrizatin Cnfiguring Header Authenticatin Cnfiguring Kaltura Authenticatin and Authrizatin fr MediaSpace Sectin 4 Organizatinal Strategy fr MediaSpace Entitlements Terminlgy Planning Cnsideratins Channel Management Types Creating Channels in MediaSpace by Users Creating Channels Centrally by Administratrs Creating MediaSpace Channels in Bulk Creating MediaSpace Channels Individually Assigning Permissins and Entitlements Setting Up Members and Permissins Manually in MediaSpace Setting Up Permissins Centrally in Bulk Setting Up Permissins Individually Autmatically Updating Permissins Deleting MediaSpace Channels Deactivating Channel Memberships Setting Up the Initial Add Members Aut-Cmplete List Updating the Add Members Aut-Cmplete List Sectin 5 Setting the Hme Page Cnfiguring yur Hme Page Sectin 6 Custmizing the Lk and Feel Chsing a Different Included Style Uplading yur Own Custm Style Sectin 7 MediaSpace Administratin: Actins and Cnfigurable s User Management Cnfiguratin Management: Glbal Applicatin Client Rles Auth Gallery Player Widgets Metadata Header Navigatin Categries Channels Debug Mderatin Cnfiguratin Management: Mdules Kaltura MediaSpace Setup Guide 4

5 Cntents Addcntent Addtplaylists Btswatch Captins Cmments Cssuplad Custmdata ntificatins Embed Embedplaylist Facebk Headermenu Hme Oembed Publish Related Screencapture Sidemymedia Sideplaylists Categry Mdules Channel Mdules Entry Type Mdules Kaltura MediaSpace Setup Guide 5

6 Preface This preface cntains the fllwing tpics: Abut this Guide Audience Dcument Cnventins Related Dcumentatin Abut this Guide This dcument details the setup required fr Kaltura MediaSpace (KMS) Versin 5.0 fllwing installatin r upgrade. The dcument describes hw t set up yur site structure, preppulate Kaltura MediaSpace cntent, assign user permissins, and implement authenticatin and authrizatin. NOTE: Yu perfrm sme setup steps in the Kaltura MediaSpace Administratin Area and in the Kaltura Management Cnsle (KMC). NOTE: Please refer t the fficial and latest prduct release ntes fr last-minute updates. Technical supprt may be btained directly frm: Kaltura Supprt. Cntact Us: Please send yur dcumentatin-related cmments and feedback r reprt mistakes t knwledge@kaltura.cm. We are cmmitted t imprving ur dcumentatin and yur feedback is imprtant t us. Audience This dcument is intended fr Kaltura MediaSpace site administratrs. Dcument Cnventins Kaltura uses the fllwing admnitins: Nte Wrkflw NOTE: Identifies imprtant infrmatin that cntains helpful suggestins. Kaltura MediaSpace Setup Guide 6

7 Preface Wrkflw: Prvides wrkflw infrmatin. 1. Step 1 2. Step 2 Related Dcumentatin In additin t this guide, the fllwing prduct dcumentatin is available: Kaltura MediaSpace Kaltura Management Cnsle (KMC) User Manual Kaltura s Entitlement Infrastructure Infrmatin Guide Kaltura s Entitlement Infrastructure Bulk Services Kaltura MediaSpace Setup Guide 7

8 SECTION 1 Understanding the MediaSpace Setup Kaltura MediaSpace features fine grained gvernance rules that grant specific permissins t cntent n the MediaSpace site. T explain yur ptins, this dcument describes the different site sectins, rles, and permissins that yu can cnfigure fr MediaSpace. This dcument fcuses n setups that include user permissins, referred t as entitlement enabled. T start learning abut MediaSpace, refer t the Kaltura MediaSpace User Manual, which describes channels and user permissins in terms f site features. Enabling User Permissins Prerequisites Cntact yur Kaltura Prject/Accunt Manager t cnfirm that the fllwing prerequisites are implemented: Entitlement services are enabled and Default Entitlement Enfrcement is set t true in yur accunt settings. (Optinal) The Like feature is enabled in yur accunt settings. A rt categry is set up fr MediaSpace in the KMC (see T set up a MediaSpace categry tree in the KMC.) Assigning user permissins usually is handled in bulk using a cmma-separated value (CSV) file. T learn mre abut the End-User Entitlements CSV, refer t the End-User Entitlements CSV. Understanding Cntent Cllectins Cntent cllectins in MediaSpace are defined as either categries r channels. Yur MediaSpace instance can include ne r bth. Understanding Categries Categries represent a centrally curated structure and hierarchy that is available frm the MediaSpace navigatin side panel. Media can be rganized arund specific tpics in either a hierarchal r a flat navigatin layut. When MediaSpace is used as a cmpany/institutin-wide media prtal, categries usually are shared with the entire rganizatin and als may be available t the public n the web. Categries define the taxnmy and hierarchical structure f yur MediaSpace site. Yu can access categries thrugh the Navigatin icn and brwse yur cntent accrding t the categries they are cntained in. Each categry pens up the list f sub-categries that are pre-cnfigured by yur accunt administratr. Understanding Channels Channels are media cllectins that can be accessed by a subset f users (r all authenticated users). Channels can be created and managed by authrized MediaSpace users r can be prvisined centrally by a KMC admin. Kaltura MediaSpace Setup Guide 8

9 Understanding the MediaSpace Setup Categries vs. Channels What are they? Wh can create? Where d they appear? Optins Categries Centrally curated hierarchical structure that defines the taxnmy f yur site KMC user nly Navigatin panel Entitlements Mderatin Grup Offline Synchrnizatin Inherit members frm parent categry Imprt members frm parent categry Channels User generated cllectins that are persnally managed Any MediaSpace user (cnfigurable accrding t applicatin rles) My Channels All Channels Inside a categry Entitlements Mderatin Grup Offline Synchrnizatin Understanding Rles and Permissins fr Categries and Channels Entitlement permissins are used t assign permissins t categries r channels (fr example, enabling a user t add cntent t a channel). Applicatin Rles apply glbally, while entitlement permissins are cntextual. An example f cntextual channel permissins is a user with Manager permissins fr ne channel and lwer-level Cntributr permissins fr anther channel. Fr a user t perfrm an actin that a permissin allws, the actin must be allwed by the user's applicatin rle. Therefre, yu must ensure that a user with a permissin f Cntributr r higher (see Understanding Permissins) is assigned a rle f privateuplader r higher (see Applicatin Rles). Otherwise, the user is nt able t uplad cntent t MediaSpace despite the permissin that entitles the user t cntribute cntent. A Channel Manager can assign permissins in MediaSpace. The channel manager selects the kind f access that users have fr the channel. If the channel type is restricted r private, the channel manager adds members and assigns member permissins. T learn mre, refer t the Kaltura MediaSpace User Manual. Understanding Privacy Types MediaSpace supprts the fllwing privacy types fr categries: Open: All users are entitled t access the categry (annymus r authenticated, depending n the cnfiguratin f yur site) but nly specific users are entitled t cntribute cntent Restricted: All authenticated users are entitled t access the categry, but nly specific users are entitled t cntribute cntent. Private: Only specific users are entitled t access the channel and t cntribute cntent. MediaSpace supprts the fllwing privacy types fr channels: Open: All authenticated users are entitled t access the channel and cntribute cntent. Restricted: All authenticated users are entitled t access the channel, but nly specific users are entitled t cntribute cntent. Private: Only specific users are entitled t access the channel and t cntribute cntent. Kaltura MediaSpace Setup Guide 9

10 Understanding the MediaSpace Setup Channel type definitins are displayed in MediaSpace under Channel Edit>Details: KMC entitlement definitins are displayed in the KMC under Cntent>Categries>Edit Categry windw>entitlements tab: NOTE: If mdificatins are made in the KMC that d nt crrespnd t ne f the channel types, MediaSpace behavir will fllw the KMC definitin, nt the designated type. Fr mre infrmatin, refer t Hw t set entitlement settings in the KMC. Understanding Applicatin Rles MediaSpace applicatin rles apply glbally and include: annymusrle Can brwse yur site annymusly until trying t access pages/actins Kaltura MediaSpace Setup Guide 10

11 Understanding the MediaSpace Setup that require lgin: My Media, My Playlists, and Add New. viewerrle Can brwse public galleries Is nt authrized t uplad new cntent Des nt have a My Media page privateonlyrle Can uplad cntent t My Media Cannt publish t galleries Can add media adminrle Can cntribute cntent t all categries Can uplad cntent unmderatedadminrle Can uplad cntent and bypass mderatin (when mderatin is enabled fr an accunt) MediaSpace applicatin rles are backward cmpatible. Mdifying Applicatin Rle Names Yu can mdify MediaSpace applicatin rle names t match yur institutinal terminlgy. T mdify MediaSpace applicatin rle names On the Cnfiguratin Management panel f the Kaltura MediaSpace Administratin Area, pen the Rles tab. Mdify the label fr ne r mre rles, and click Save. Assigning Applicatin Rles t Multiple Users in Bulk Yu can assign applicatin rles t multiple users with a bulk actin. Yu use an End Users CSV that includes an ptin t assign rles. T uplad an End Users CSV D ne f the fllwing: In the KMC, uplad the End-Users CSV. Refer t the End-Users CSV - Usage and Kaltura MediaSpace Setup Guide 11

12 Understanding the MediaSpace Setup Schema Descriptin. On the User Management panel f the Kaltura MediaSpace Administratin Area: - Click Submit CSV. - Click Chse File t select the CSV file, and click OK. Understanding Entitlement Permissins While an applicatin rle applies t yur entire MediaSpace site, sme permissins may be categry r channel-specific. Yu set user permissins t a specific cntent cllectin by applying the fllwing permissin levels: Member: Can access a channel r categry but cannt add new cntent Cntributr: Can add cntent t a channel r categry Mderatr: In additin t the Cntributr permissin, can mderate cntent. Manager: In additin t the Cntributr permissin, can mderate cntent and access settings, including change metadata, edit members, change appearance, and delete channel. See Understanding Rles and Permissins. In channels: All permissin levels are relevant fr channels. In galleries: Only the Cntributr and Member permissin levels are relevant t galleries. Assigning a list f users as Members enables the users nly t access a gallery. Assigning a list f users as Cntributrs enables the users t access a gallery and add media. (A user with the Admin applicatin rle als can add media.) Understanding Rles and Permissins Wh can uplad cntent t MediaSpace? A user with an applicatin rle f privateonlyrle and higher (adminrle, unmderatedadminrle) can uplad cntent t MediaSpace. Wh can view categries? By default, categries can be accessed by all authrized users. Kaltura MediaSpace Setup Guide 12

13 Understanding the MediaSpace Setup When Annymus mde is enabled, pen categries can als be viewed by annymus users. T enable Annymus mde On the Cnfiguratin Management panel f the Kaltura MediaSpace Administratin Area, pen the Auth tab. Under allwannymus, select Yes and click Save. Wh can view r cntribute cntent t a categry/channel? The fllwing table describes the different scenaris depending n yur KMS cnfiguratin and entitlements settings: Privacy Type Actin Categry Channel Open View Annymus + (if KMS is enabled fr annymus mde) Cntribute Cntributr + adminrle + Any Authenticated User Any Authenticated User Restricted View Any Authenticated User Any Authenticated User Cntribute Cntributr + Cntributr + Private View Member + Member + Cntribute Cntributr + Cntributr + Hw des a user becme a manager? A user can becme a manager in the fllwing ways: The End-User Entitlements CSV includes fields fr assigning a manager, cntributrs, and member permissins fr each user and channel. An authrized user wh creates a channel is assigned as the channel wner with managerial rights. An wner can add additinal managers, cntributrs, and members t a channel. Hw des a user jin a channel? An end user cannt jin a channel. The sys-admin r channel manager must authrize the user. An authenticated user can access channels that are Open r Restricted. Wh can create a channel? A user with a rle that is defined as a channel creatr can create a channel. Yu define the user rles that can create a channel. See Setting Permissins fr Creating a MediaSpace Channel. Wh can delete a channel? The fllwing are authrized t delete a channel: Frm MediaSpace: The channel wner/manager Frm the KMC: A KMC admin Kaltura MediaSpace Setup Guide 13

14 SECTION 2 Setting up MediaSpace This sectin describes the fllwing tpics: Setting up MediaSpace Cntent in the KMC Uplading MediaSpace Cntent Setting up MediaSpace Galleries in the KMC Setting up MediaSpace Channels Assigning User Permissins t MediaSpace Channels Setting up MediaSpace t Run n HTTPS Setting up MediaSpace Cntent in the KMC T set up a MediaSpace categry tree in the KMC 1. In the KMC, create a MediaSpace rt categry. a. Select the Cntent tab and then select the Categries tab. b. Click Add Categry. c. On the New Categry windw, select the psitin f the rt categry and save yur new categry. d. In the New Categry windw, enter metadata fr the new categry and click Save. Kaltura MediaSpace Setup Guide 14

15 Setting up MediaSpace 2. In MediaSpace, define the rt categry. a. On the Cnfiguratin Management panel f the Kaltura MediaSpace Administratin Area, pen the Categries tab. b. Under rtcategry, select the categry that yu created, and click Save. 3. In the KMC, verify yur rt categry and sub-categries. a. Select the Cntent tab and then select the Categries tab. b. Verify that the rt categry is displayed with new sub-categries. Kaltura MediaSpace Setup Guide 15

16 Setting up MediaSpace NOTE: The Archive categry is reserved fr future versins. The Private categry cntains all cntent upladed t the MediaSpace site that has nt been published t galleries and channels. D nt change the Private categry settings. 4. In the KMC, verify that the rt categry is assigned a Privacy Cntext. A Privacy Cntext is defined during MediaSpace installatin r using the KMC. Refer t Hw t add Entitlements t Categries. a. In the KMC, select the Cntent tab and then select the Categries tab. b. In the Categries table, click the rt categry name. c. On the Edit Categry windw, select the Entitlements tab. d. Under Privacy Cntext Label, cnfirm that a value is displayed. Uplading MediaSpace Cntent T uplad initial cntent fr MediaSpace in the KMC In the KMC, select the Uplad tab and then d ne f the fllwing: Click Uplad frm Desktp. Use this ptin t uplad a small number f files. Under Submit Bulk, select Entries CSV/XML. Use this ptin t uplad a large number f files. Using this ptin, yu als imprt metadata such as categries and tags. Kaltura MediaSpace Setup Guide 16

17 Setting up MediaSpace T learn mre abut uplading and ingestin, refer t the Kaltura Management Cnsle (KMC) User Manual. Setting up MediaSpace Categries in the KMC After yu set up a MediaSpace categry tree, yu can create categries and channels. T learn mre abut Creating and Managing Cntent Categries, see Hw t Create and Manage Cntent Categries? T add MediaSpace categries manually in the KMC In the KMC, select the Cntent tab and then select the Categries tab. Click Add Categry. Add a categry under [MediaSpace rt]>site>galleries, and save yur new categry. T create MediaSpace categries in bulk in the KMC In the KMC, select the Uplad tab and, under Submit Bulk, select Categries CSV. Specify the path fr the gallery categries under [MediaSpace rt]>site>galleries. T specify the rder f MediaSpace gallery categries in the KMC 1. By default, categries in MediaSpace are displayed by their creatin date (the mst recent appears last). In the KMC, select the Cntent tab and then select the Categries tab. Kaltura MediaSpace Setup Guide 17

18 Setting up MediaSpace 2. Click galleries in the Categries table t pen the Edit Categry windw. 3. On the Edit Categry windw, select the Sub Categries tab (displayed nly when there is mre than ne sub-categry): Specify the rder f the sub-categries using the Up and Dwn arrws, and click Save. Repeat fr additinal sub-categry levels under galleries. T set the wner f a categry manually in the KMC 1. By default, categries in MediaSpace are added withut an wner. T delegate the management f a specific categry t a MediaSpace user and allw that user t cnfigure that categry and manage members, yu shuld assign the apprpriate MediaSpace user as the categry wner. In the KMC, select the Cntent tab and then select the Categries tab. Kaltura MediaSpace Setup Guide 18

19 Setting up MediaSpace Search fr the categry that yu want t set the wner fr, and pen the Edit Categry windw. On the Edit Categry windw, select the Entitlements tab. Yu will ntice that the Owner is nt specified Click Change. Enter the user name r user ID f the apprpriate wner fr this categry and click Save. Adding Cntent t yur MediaSpace Categries After yur categry structure is set up, yu can publish cntent t yur categries. Yu can add entries t categries in the KMC n the Uplad tab's Submit Bulk menu using the Entries CSV/XML ptin. Categries that d nt exist are created when yu submit the file. T display these categries in MediaSpace, specify the [MediaSpace Rt]>site>galleries path. T learn mre abut Assigning Cntent t Categries, refer t Hw t create Categries and Assign Entries t a Categry. T manually assign cntent t a MediaSpace categry in the KMC In the KMC, select the Cntent tab and then select the Entries tab. In the Entries table, select ne r mre entries and click Bulk Actins. Kaltura MediaSpace Setup Guide 19

20 Setting up MediaSpace 3. Select Add/Remve Categries and click Add t Categries. 4. On the Select Categries windw, under the galleries categry, select ne r mre categries and click Apply: In the Entries table, the entries are displayed fr the categry yu used as a filter. Kaltura MediaSpace Setup Guide 20

21 Setting up MediaSpace Als, see Assigning MediaSpace Cntent t Channels. T change an entry s MediaSpace cntent wner in the KMC Usually, the user wh uplads cntent in the KMC is nt the administrative cntent wner f the media entry. Refer t Hw t change the categry wner in the KMC r KMS. NOTE: The cntent wner is the user that has the manager permissin level fr this categry and can manage the categry settings frm the applicatin. Adding Members and Cntributrs via the KMC T add a user as a cntributr t a MediaSpace categry in the KMC In the KMC, select the Cntent tab and then select the Categries tab. In the Categries table, click the categry name. On the Edit Categry windw, select the Entitlements tab. Under Specific End-User Permissins, click Manage. Kaltura MediaSpace Setup Guide 21

22 Setting up MediaSpace 5. On the Specific End-User Permissins windw, click Add Users On the Add Users windw, under Permissin Level select Cntributr. On the Add Users windw, under Select End-Users start typing a user name. A list f suggestins is displayed after yu type the third character. Kaltura MediaSpace Setup Guide 22

23 Setting up MediaSpace 8. On the Add Users windw, select a user frm the suggestin list and click Save. In MediaSpace, the selected user will have the Add Media ptin fr the specified gallery. Setting up MediaSpace Channels Setting up MediaSpace channels in the KMC is similar t setting up categries. T learn abut what s unique fr channels, see Assigning User Permissins t MediaSpace Channels in the KMC. Displaying Channels in MediaSpace This sectin describes the fllwing tpics: Adding a Link t the Channels Page and My Channels in the Tp MediaSpace Navigatin Adding a Link t My Channels in the MediaSpace Header Menu Assciating Channels t Categries T add a link t the Channels page and My Channels in the tp MediaSpace navigatin On the Cnfiguratin Management panel f the Kaltura MediaSpace Administratin Area, pen the Navigatin tab. Under pre: a. In the type menu, select Channels Page r My Channels. b. In the name field, enter the label t display. 3. Click Save t display the link in the tp MediaSpace navigatin bar. Kaltura MediaSpace Setup Guide 23

24 Setting up MediaSpace T add a link t My Channels in the header menu On the Cnfiguratin Management panel f the Kaltura MediaSpace Administratin Area, pen the Headermenu tab. Under enabled, select Yes t enable the Headermenu mdule. Under menu: a. In the type menu, select My Channels. b. In the label field, enter the label t display. 4. Click Save t display the link in the MediaSpace header menu. Assciating Channel t Categries When yu create a channel, yu can assciate a channel t a categry. When users navigate t a categry page, they will be able t brwse the media and als the channels assciated with that categry. T enable assciating channels t categries when creating a channel 1. On the Cnfiguratin Management panel f the Kaltura MediaSpace Administratin Area, pen the Channelcategries tab Under enabled, select Yes t enable the Channelcategries mdule. Click Save. Setting Permissins fr Creating a MediaSpace Channel See Wh can create a channel? Kaltura MediaSpace Setup Guide 24

25 Setting up MediaSpace T define a user rle with permissins t create a channel On the Cnfiguratin Management panel f the Kaltura MediaSpace Administratin Area, pen the Channels tab. Under channelcreatr, select ne f the fllwing rles, and click Save. Sys Admin Channels can be created nly frm the KMC by the KMC admin user. viewerrle All authenticated users privateonlyrle All users with uplad permissins adminrle All users with permissin t uplad and publish t all categries unmderatedadminrle All users with permissin t uplad and publish t categries and t bypass mderatin (if mderatin is enabled) NOTE: We d nt recmmend enabling a Viewer t create channels since Viewers cannt add cntent t channels they create. When a user has permissins t create a channel, a Create Channel buttn is displayed n Channel Listing pages. Assigning MediaSpace Cntent t Channels T manually assign cntent t a MediaSpace channel in the KMC In the KMC, select the Cntent tab and then select the Entries tab. In the Entries table, select ne r mre entries and click Bulk Actins. Kaltura MediaSpace Setup Guide 25

26 Setting up MediaSpace 3. Select Add/Remve Categries and click Add t Categries. 4. On the Select Categries windw, under the channels categry, select ne r mre categries and click Apply: In the Entries table, the entries are displayed when yu filter fr a categry t which yu assigned the entries. Als see Adding Cntent t yur MediaSpace Categries. Assigning User Permissins t MediaSpace Channels T assign user permissins in bulk, use the End-User Entitlements CSV. T learn mre abut assigning end-user permissins, refer t the Kaltura Management Cnsle (KMC) User Manual. T learn mre abut entitlement services and hw they apply t MediaSpace permissins, refer t Intrductin t the Kaltura Entitlement Infrastructure. Assigning User Permissins t MediaSpace Channels in the KMC By default, a channel that yu create in the KMC is restricted t authenticated users. Handling permissin restrictins fr channels is similar t the way yu handle permissins fr galleries. See Adding Cntributrs t MediaSpace Galleries. In additin, yu perfrm the fllwing imprtant flws related t channels in the KMC: Assigning Managers t a MediaSpace Channel Assigning User Permissins t a Channel in MediaSpace Assigning Managers t a MediaSpace Channel T access channel settings in MediaSpace, a user must have Manager permissins fr the channel. T learn mre abut channel settings, refer t the Kaltura MediaSpace User Manual. T assign a manager t a MediaSpace channel in the KMC In the KMC, select the Cntent tab and then select the Categries tab. In the Categries table, click the channel categry name. Kaltura MediaSpace Setup Guide 26

27 Setting up MediaSpace On the Edit Categry windw, select the Entitlements tab. Under Specific End-User Permissins, click Manage. On the Specific End-User Permissins windw, d ne r mre f the fllwing: In the user list, select ne r mre users and change the user permissin t Manager. Click Add Users. - On the Add Users windw, under Permissin Level select Manager/Mderatr. - On the Add Users windw, under Select End-Users start typing a user name. A list f suggestins is displayed after yu type the third character. - On the Add Users windw, select a user frm the suggestin list and click Save. NOTE: A MediaSpace end user wh creates a channel can assign permissins, including adding managers and mderatrs. Assigning User Permissins t a Channel in MediaSpace Channel managers and wners can add members and change user permissins in MediaSpace. T edit channel members and permissins in MediaSpace In MediaSpace, n the Channels page r yur My Channels page, click a channel t pen the channel page, and then click Actins Edit. On the Members tab: T mdify the member's permissin level, next t the member's Permissin clumn, click the Pencil icn, select a new permissin, and click Dne. T remve the member frm channel membership, click X icn. T add a member and assign a permissin level t the new member, click Add Member, enter a user name and select a permissin, and click Add. T set a different member as the channel wner, click the Set as Owner link. NOTE: This peratin is available t current wner nly and will transfer wnership frm yu t selected member. T learn mre abut editing channel users, refer t the Kaltura MediaSpace User Manual. Kaltura MediaSpace Setup Guide 27

28 Setting up MediaSpace Setting up MediaSpace t Run n HTTPS Yu can cnfigure MediaSpace t run n HTTPS. T run MediaSpace n HTTPS D ne f the fllwing: Use HTTPS fr lgin nly. a. On the Cnfiguratin Management panel f the Kaltura MediaSpace Administratin Area, pen the Auth tab. b. Under sslsettings, select Lgin nly and click Save. c. On the Cnfiguratin Management panel f the Kaltura MediaSpace Administratin Area, pen the Client tab. d. Under serviceurl, enter an HTTP URL and click Save. Use HTTPS fr yur MediaSpace site. NOTE: T run MediaSpace n HTTPS, cntact yur Kaltura Prject Manager r Accunt Manager fr assistance. D nt attempt t run MediaSpace n HTTPS befre cnsulting yur Kaltura representative. Implement the fllwing prcedure when yur Kaltura representative instructs yu t d s. a. On the Cnfiguratin Management panel f the Kaltura MediaSpace Administratin Area, pen the Auth tab. b. Under sslsettings, select All site and click Save. c. On the Cnfiguratin Management panel f the Kaltura MediaSpace Administratin Area, pen the Client tab. d. Under serviceurl, enter an HTTPS URL and click Save. Kaltura MediaSpace Setup Guide 28

29 SECTION 3 Authenticating and Authrizing Users in MediaSpace Use the Cnfiguratin Management panel Auth tab f the Kaltura MediaSpace Administratin Area t cnfigure the authenticatin and authrizatin methds fr accessing MediaSpace cntent. Access is based n the Applicatin rle cnfigured fr the user. The fllwing scenaris are supprted: Scenari 1: Authenticatin and Authrizatin Are Managed in Organizatinal Systems Scenari 2: Authenticatin and Authrizatin Are Managed in Kaltura Scenari 3: Authenticatin Is Managed in an Organizatinal System, Authrizatin Is Managed in Kaltura Usually, bth authenticatin and rle authrizatin are set thrugh integratin with the rganizatinal identity and grup management systems (Scenari 1). Kaltura s authenticatin and/r authrizatin ptins may be useful in the cases described in Scenaris 2 and 3. NOTE: User authrizatin t channel and cntent entitlements is handled separately. Scenari 1: Authenticatin and Authrizatin Are Managed in Organizatinal Systems When des this scenari apply? Yu can use yur rganizatinal system as yur MediaSpace identity and rle authrizatin prvider when: Yu have a large-scale MediaSpace deplyment. Yu want all users t lg int MediaSpace with their rganizatinal credentials and t be authenticated by yur centralized authenticatin system. Yu can prvide access frm the MediaSpace applicatin t yur authenticatin and grup management systems. Authrizatin t access MediaSpace with a specific Applicatin Rle derive in mst cases frm user membership in rganizatinal units r grups. Wh can access MediaSpace? Only users wh are authenticated and authrized by yur systems can access MediaSpace. Users wh are nt authenticated by yur systems are denied access t MediaSpace and are nt able t lg in. What user details are stred in Kaltura? The user s identifier, Applicatin Rle, and first and last names (ptinal but recmmended) must be stred in Kaltura. After the user lgs int MediaSpace fr the first time, administratrs can view and manage the user recrd n the User Management panel f the Kaltura MediaSpace Administratin Area. The user s rganizatinal passwrd is nt saved in Kaltura. Kaltura MediaSpace Setup Guide 29

30 Authenticating and Authrizing Users in MediaSpace Can yu manually set different user details in Kaltura? Yes, yu can manually set different user details in Kaltura. After the user lgs int MediaSpace fr the first time, administratrs can manage the user recrd n the User Management panel f the Kaltura MediaSpace Administratin Area. An administratr can verride the user details (first and last name) and the user MediaSpace Applicatin Rle. This ptin is useful mainly fr granting a higher- r lwer-level Applicatin Rle t certain users. Fr example, yu can set a Viewer Applicatin Rle t a large grup f peple within yur rganizatin and then manually assign the higher level MediaSpace Admin rle t a few f them. T enable verriding settings manually On the Cnfiguratin Management panel f the Kaltura MediaSpace Administratin Area, pen the Auth tab. Set the fllwing values and click Save. a. Under refreshdetailsonlgin, select N. This ptin is displayed nly when using an external authenticatin prvider. b. Under refreshrleonlgin, select N. This ptin is displayed nly when using an external rle authrizatin prvider. Scenari 2: Authenticatin and Authrizatin are Managed by Kaltura When des this scenari apply? Yu can use Kaltura as yur MediaSpace identity and rle authrizatin prvider when: Yu want t launch a MediaSpace pilt in yur rganizatin withut IT integratin. Yu want t quickly g live with yur rganizatinal vide prtal befre perfrming IT integratin with yur rganizatinal authenticatin and grup management systems. Only a few users in yur rganizatin need t wrk with MediaSpace, and there is n requirement r need fr managing user authenticatin and credential validatin in yur rganizatinal systems. Yu d nt have a centralized authenticatin system r yu are nt able t prvide access t yur authenticatin system frm the MediaSpace applicatin. Wh can access MediaSpace? Only users with a MediaSpace user accunt pre-prvisined in Kaltura can access MediaSpace. (The user accunt must include a MediaSpace Rle and a MediaSpace passwrd.) If yu want t revke MediaSpace access frm a specific user, it is yur respnsibility t delete the user accunt in ne f the fllwing ways: On the User Management panel f the Kaltura MediaSpace Administratin area, select ne r mre users, and click Delete r Delete Checked. Submit a Kaltura end-users CSV t delete MediaSpace user accunts in bulk. T learn mre, see the submit a Kaltura end-users CSV prcedure step. Use the Kaltura API t: Delete the user recrd. Remve the user's MediaSpace Rle stred in a custm data prfile. Kaltura MediaSpace Setup Guide 30

31 Authenticating and Authrizing Users in MediaSpace Hw d yu switch frm Kaltura-managed authenticatin and authrizatin t managing MediaSpace authenticatin and authrizatin in yur system? Fllwing the cmpletin f yur pilt, r when the IT integratin with yur user authenticatin and grup management systems is cmpleted, n the Cnfiguratin Management panel f the Kaltura MediaSpace Administratin Area, pen the Auth tab and change the selected authenticatin/authrizatin methd. In the Kaltura MediaSpace Administratin Area, yu may verride the Kaltura-managed Applicatin Rles frm yur system n the Cnfiguratin Management panel r by manually deleting existing MediaSpace user accunts n the User Management panel. T verride Kaltura-managed Applicatin Rles n the Cnfiguratin Management panel On the Cnfiguratin Management panel f the Kaltura MediaSpace Administratin Area, pen the Auth tab. Set the fllwing values and click Save. a. Under refreshdetailsonlgin, select Yes. This ptin is displayed nly when using an external authenticatin prvider. b. Under refreshrleonlgin, select Yes. This ptin is displayed nly when using an external rle authrizatin prvider. Scenari 3: Authenticatin is Managed in an Organizatinal System, Authrizatin is Managed by Kaltura When des this scenari apply? Yu can use Kaltura as yur MediaSpace access and rle authrizatin prvider when: Yu have a small- t large-scale MediaSpace deplyment. Yu want all users t lg int MediaSpace with their rganizatinal credentials and t be authenticated by yur centralized authenticatin system. Authrizatin fr users t access MediaSpace and MediaSpace Applicatin Rles is independent f their membership in rganizatinal units r grups. Fr example, users wh will be granted MediaSpace access d nt belng t a specific rganizatinal unit r grup. Yu are nt able t prvide access t yur grup management system frm the MediaSpace applicatin fr setting grup-based rle authrizatin. Yu want t set users' applicatin rles befre their first lgin t MediaSpace. Wh can access MediaSpace? Only users wh are authenticated by yur systems and have MediaSpace user accunts pre-prvisined in Kaltura (the user accunt includes MediaSpace Applicatin Rles) can access MediaSpace. Users wh are nt authenticated by yur systems are denied access t MediaSpace, even if they are have a user accunt and a MediaSpace Applicatin Rle in Kaltura. These unauthenticated users will nt be able t lg in. Kaltura MediaSpace Setup Guide 31

32 Authenticating and Authrizing Users in MediaSpace Enabling Cmmn Lgin Cnfiguratins On the Cnfiguratin Management panel Auth tab f the Kaltura MediaSpace Administratin Area, the fllwing MediaSpace lgin ptins are available fr all authenticatin and authrizatin methds. Enabling Authenticatin Methds On the Cnfiguratin Management panel Auth tab f the Kaltura MediaSpace Administratin Area, the fllwing authenticatin methds are supprted as part f the MediaSpace standard installatin. When yu select an authenticatin adapter, a set f relevant cnfiguratin fields is displayed t fill in. LDAP Authenticatin User authenticatin and credentials validatin thrugh direct access t the rganizatinal LDAP r Active Directry server. SSO Gateway Authenticatin A Kaltura generic gateway fr integrating with a custmer- specific lgin and authenticatin implementatin, while prviding the user with a Single Sign-On experience. Header Authenticatin User is authenticated thrugh a request in the rganizatinal authenticatin system. The respnse includes the authenticated user ID in a specific HTTP header. Kaltura Authenticatin User authenticatin and credentials managed by Kaltura. Custm Authenticatin Methds Fr any ther type f authenticatin methd, custm adapters can be develped and added t the MediaSpace installatin. Enabling Authrizatin Methds On the Cnfiguratin Management panel Auth tab f the Kaltura MediaSpace Administratin Area, the fllwing authrizatin methds are supprted as part f the MediaSpace standard installatin. When yu select an authrizatin methd, a set f relevant cnfiguratin fields is displayed t fill in. Kaltura MediaSpace Setup Guide 32

33 Authenticating and Authrizing Users in MediaSpace LDAP Authrizatin The user s applicatin rle in MediaSpace is determined based n rganizatinal grups in which the user is a member, which are managed in the rganizatin s LDAP server. This authrizatin methd usually is used tgether with the LDAP authenticatin methd. The methd als can be selected when using ther authenticatin methds (SSO Gateway authenticatin, Kaltura authenticatin, and Header authenticatin). SSO Gateway Authrizatin - The user s applicatin rle in MediaSpace is set and passed t MediaSpace as part f the custmer-specific lgin and authenticatin implementatin, which is set thrugh the Kaltura SSO gateway interface. Always use this ptin with SSO Gateway authenticatin. This ptin cannt be used with any authenticatin methd besides SSO Gateway authenticatin. Kaltura Authrizatin Manage user authrizatin t access MediaSpace and user MediaSpace applicatin rles in Kaltura. This authrizatin ptin can be used with any ther authenticatin methd (SSO Gateway authenticatin, Kaltura authenticatin, and Header authenticatin). Custm Authrizatin Methds Fr any ther type f access and rle authrizatin methd, custm adapters can be develped and added t the MediaSpace installatin. Cnfiguring LDAP Authenticatin and Authrizatin T learn mre abut integrating yur LDAP server fr authenticating users and authrizing user access t MediaSpace with a specific applicatin rle, refer t Kaltura MediaSpace Intrductin t Authenticatin and Authrizatin Slutins and Kaltura MediaSpace LDAP Integratin Guide. T cnfigure user authenticatin thrugh yur LDAP server On the Cnfiguratin Management panel f the Kaltura MediaSpace Administratin Area, pen the Auth tab. Under authnadapter, select LDAP AuthN Select yur preferences fr the cmmn lgin ptins. Under refreshdetailsonlgin, select yur preference. This ptin affects the updating f the user s first name, last name, and address (when prvided) frm yur LDAP system upn every lgin. 5. Under ldapserver: a. Select the LDAP Server access and bind settings. Yur bindmethd selectin will affect the infrmatin yu need t prvide fr authenticating the user. Kaltura MediaSpace Setup Guide 33

34 Authenticating and Authrizing Users in MediaSpace b. Select the LDAP attributes fr first name, last name and address. Ppulating the user s first and last name is used fr several MediaSpace ptins that require the user name. The address is ptinal. This field is useful fr user management and fr future features (such as ntificatins). Kaltura MediaSpace Setup Guide 34

35 Authenticating and Authrizing Users in MediaSpace If yu are using yur LDAP server t authrize user access t MediaSpace with a specific applicatin rle, cntinue with the next prcedure. If nt, select a different authrizatin methd. After yu cmplete and verify the steps, click Save. T cnfigure user authrizatin thrugh yur LDAP server On the Cnfiguratin Management panel f the Kaltura MediaSpace Administratin Area, pen the Auth tab. Under authzadapter, select LDAP AuthZ. 3. Under refreshrleonlgin, select yur preference. This ptin affects the updating f the user s rle frm yur LDAP system upn every lgin. 4. Under ldapoptins, select yur preferences fr getting the list f grups in which the user is a member. This ptin is used t determine the user's MediaSpace Applicatin Rle. Under grupsmatchingorder, enter the rder fr matching MediaSpace rles t LDAP grups. The rder determines whether the strngest r weakest rle is mapped first. Yur grupsearch selectin will affect the infrmatin yu need t prvide. Kaltura MediaSpace Setup Guide 35

36 Authenticating and Authrizing Users in MediaSpace Kaltura MediaSpace Setup Guide 36

37 Authenticating and Authrizing Users in MediaSpace 5. Under ldapgrups, select yur preferences t define the mappings between the grups defined in yur LDAP server and the MediaSpace Applicatin Rles. 6. After yu cmplete and verify the steps, click Save. Cnfiguring SSO Gateway Authenticatin and Authrizatin T learn mre abut integrating MediaSpace with yur authenticatin systems using the MediaSpace SSO Gateway, refer t Kaltura MediaSpace Intrductin t Authenticatin and Authrizatin Slutins and Kaltura MediaSpace SSO Integratin Guide. T cnfigure user authenticatin using the MediaSpace SSO gateway On the Cnfiguratin Management panel f the Kaltura MediaSpace Administratin Area, pen the Auth tab. Under authnadapter, select SSO Gateway AuthN Select yur preferences fr the cmmn lgin ptins. Under refreshdetailsonlgin, select yur preference. This ptin affects the updating f the user s first name, last name and address (when prvided) frm yur authenticatin system upn every lgin. Kaltura MediaSpace Setup Guide 37

38 Authenticating and Authrizing Users in MediaSpace 5. Under ss, select yur preferences fr integrating the MediaSpace SSO Gateway with yur lgin implementatin: secret Enter the secret string shared with the lgin page. The default value uses yur Kaltura Admin Secret (accessible frm KMC -> Settings -> Integratin Settings). lginurl Enter the abslute URL where yu hst the lgin page. lguturl Enter the URL t which MediaSpace redirects a user after invalidating the lcal MediaSpace sessin (fr example, when a user clicks lgut). - On yur site yu may use this page t invalidate ther authenticated sessins, if needed (fr example, CAS lgin). - A sessinkey URL parameter is autmatically appended t the lgut URL. This parameter securely encapsulates the user infrmatin, enabling yu t knw which user lgged ut. The sessinkey parameter is cnstructed using the secret shared with the lgin page After yu cmplete and verify the steps, click Save. If yu are using the MediaSpace SSO Gateway t authrize user access t MediaSpace with a specific applicatin rle, cntinue with the next prcedure. T cnfigure user authrizatin using the MediaSpace SSO gateway On the Cnfiguratin Management panel f the Kaltura MediaSpace Administratin Area, pen the Auth tab. Under authzadapter, select SSO Gateway AuthZ. 3. Under refreshrleonlgin, select yur preference. This ptin affects the updating f the user s rle upn every lgin. 4. After yu cmplete and verify the steps, click Save. Kaltura MediaSpace Setup Guide 38

39 Cnfiguring Header Authenticatin T cnfigure header authenticatin thrugh the MediaSpace SSO gateway On the Cnfiguratin Management panel f the Kaltura MediaSpace Administratin Area, pen the Auth tab. Under authnadapter, select Header AuthN Select yur preferences fr the cmmn lgin ptins. Under refreshdetailsonlgin, select yur preference. This ptin affects the updating f the user s first name, last name, and address (when prvided) frm yur authenticatin system upn every lgin. 5. Under headerauth, enter values fr: headername the ID f the authenticated user lguturl 6. After yu cmplete and verify the steps, click Save. Cnfiguring Kaltura Authenticatin and Authrizatin fr MediaSpace Authenticating r authrizing MediaSpace users in Kaltura requires creating MediaSpace user accunts that include a MediaSpace Applicatin Rle. Only users with a MediaSpace user accunt and MediaSpace Applicatin Rle are able t lg int MediaSpace. Authenticating MediaSpace users in Kaltura als requires setting a passwrd fr each MediaSpace user. Fllw the prcedure t create MediaSpace user accunts that include a MediaSpace Applicatin Rle. T cnfigure Kaltura authenticatin 1. On the Cnfiguratin Management panel f the Kaltura MediaSpace Administratin Area, pen the Auth tab. Kaltura MediaSpace Setup Guide 39

40 Authenticating and Authrizing Users in MediaSpace 2. Under authnadapter, select Kms_Auth AuthN Select yur preferences fr the cmmn lgin ptins. After yu cmplete and verify the steps, click Save. T cnfigure Kaltura authrizatin On the Cnfiguratin Management panel f the Kaltura MediaSpace Administratin Area, pen the Auth tab. Under authzadapter, select Kms_Auth AuthZ and click Save. T create MediaSpace user accunts that include a MediaSpace Applicatin Rle D ne f the fllwing: On the User Management panel f the Kaltura MediaSpace Administratin Area, yu can create and manage MediaSpace user accunts. Use the list t manually manage all users in the partner accunt that have a MediaSpace rle fr the specific MediaSpace instance. Submit a Kaltura end-users CSV t create MediaSpace user accunts in bulk. Use the fllwing frmat: Kaltura MediaSpace Setup Guide 40

41 Authenticating and Authrizing Users in MediaSpace T learn mre abut the end-user CSV schema, refer t End-Users CSV Usage and Schema Descriptin. The userid field must include a minimum f three characters. The MediaSpace passwrd must include a minimum f six characters. The MediaSpace Applicatin Rle is managed within the MediaSpace user metadata schema. Adjust the schema name in the example t include yur MediaSpace instanceid. (Yu can cpy the MediaSpace instanceid frm the Cnfiguratin Management panel Applicatin tab f the Kaltura MediaSpace Administratin Area.) Set the rle names in the CSV accrding t the rle labels yu set in the Cnfiguratin Management panel Rles tab f the Kaltura MediaSpace Administratin Area. When using Kaltura t authenticate users, yu may ppulate a sha1 hashed passwrd in the CSV as part f the partnerdata field, as in the example. MediaSpace administratrs are respnsible fr managing passwrd hashing and distributin t users. The un-hashed passwrd must include a minimum f six characters. When using Kaltura nly fr authrizing user access t MediaSpace with a specific applicatin rle, d nt ppulate the passwrd in the CSV. (Yu can remve the partnerdata clumn in the example frm the CSV since it is nt required.) Yu can submit the end-users CSV in the fllwing ways: - On the User Management panel f the Kaltura MediaSpace Administratin Area, click Submit CSV. - In the KMC, select the Uplad tab and then under Submit Bulk, select End-Users CSV. T autmate the update f the authrized MediaSpace users list When yu manage MediaSpace authrizatin in Kaltura, yu can develp autmated prcesses fr updating the list f MediaSpace users based n changes in yur rganizatinal infrmatin system. Yu can develp a scheduled update prcess t peridically add r delete multiple users t the MediaSpace users list using the Kaltura end-users CSV. In yur script, yu can call the user.addfrmbulkuplad Kaltura API actin t submit the CSV. Using Kaltura API actins, yu can develp a trigger-based prcess t update the MediaSpace users list in real time when changes ccur in yur rganizatinal infrmatin Kaltura MediaSpace Setup Guide 41

42 Authenticating and Authrizing Users in MediaSpace system. Yu can call the user.add, user.delete and user.update Kaltura API actins t add, delete, and update specific user recrds. Yu can call the metadata.add, metadata.delete, and metadata.update Kaltura API actins t add, delete, and update the user's MediaSpace rle. NOTE: Deleted users are als remved frm all channels in which they are members. Cntent wnership and analytics infrmatin f the deleted user are nt deleted. NOTE: Since user recrds are shared by all Kaltura applicatins running n the same accunt, we recmmend that yu delete recrds nly f users wh left the rganizatin. In ther cases, we recmmend revking the user's access t MediaSpace by using the Kaltura API t remve nly the user's MediaSpace rle r by using the User Management panel f the Kaltura MediaSpace Administratin Area t delete the user. Kaltura MediaSpace Setup Guide 42

43 SECTION 4 Organizatinal Strategy fr MediaSpace Entitlements When creating an rganizatinal vide prtal with MediaSpace, MediaSpace categries, channels and their respective user permissins can be set and maintained in different ways. When categries and channels serve rganizatinal units and grups, it may be pssible t create the channels and maintain the channel permissins based n data managed in the rganizatin s infrmatin system (fr example, identity management systems and grup management systems). This sectin addresses: Hw t plan the rganizatinal peratins and integratins related t managing user permissins Hw t create categries and channels in bulk fr grups managed in the rganizatinal infrmatin systems Hw t create and maintain user permissins based n grups managed in the rganizatinal infrmatin systems Hw t create and maintain the Add Members aut-cmplete list fr adding members manually These tasks can be accmplished in different ways since every rganizatin has different needs and requirements, deplys and supprts different infrmatin systems, and has different levels f IT capabilities and resurces. The guidelines in this dcument can be adapted t fit each rganizatin s needs and capabilities. Terminlgy User ID A user s unique identifier in yur rganizatin s infrmatin systems. The same ID is used in Kaltura as a unique identifier f the user in a specific partner accunt. Grup ID A unique identifier in yur rganizatinal infrmatin system representing an actual rganizatinal unit r an ad-hc security grup. A user can be a member f multiple grups and may hld a different rganizatinal rle in each grup. The rganizatinal rle f a user within a unit/grup may r may nt be represented within the rganizatin infrmatin system. MediaSpace Categry An pen/private/restricted categry in MediaSpace that a specific grup f users (categry members) is able t access. Categries are centrally created via the Kaltura Management Cnsle (KMC) and reflect the navigatin structure f yur MediaSpace site. The list f peple with permissin t access the categry may derive frm user membership in a specific rganizatinal grup r may be defined manually by the categry manager with n relatin t rganizatinal structure and units MediaSpace Channel An pen/private/restricted channel in MediaSpace that a specific grup f users (channel members) is able t access. The list f peple with permissins t access the grup channel may derive frm user membership in a specific rganizatinal grup r may be defined manually by the channel manager with n relatin t rganizatinal structure and units. NOTE: MediaSpace Channels can be assciated with ne r mre MediaSace Categry accrding t the entitlements set in the categry. Kaltura User A Kaltura backend bject that hlds infrmatin abut a specific user and is identified by the User ID. Kaltura supprts the management f different user attributes. The user ID is a mandatry attribute; the user s first name, last name, and screen name (by default, the user s full name) are required t enable cnvenient end-user management in MediaSpace and in the KMC. Kaltura MediaSpace Setup Guide 43