MiVideo KMC Admin: Configure MCommunity Groups With Mediaspace

Environment

MiVideo Mediaspace (KMS)

Issue

How can a KMC/Mediaspace admin create and configure additional MCommunity groups as needed to make it easier to manage users?

• Use MCommunity Group(s) for User Management 
• Use MCommunity Groups for Channel Membership and Media Membership
• Mapping Groups to Okta Attributes
• Add/Remove Members from MCommunity Groups
• Nested MCommunity Groups

Resolution

Before Beginning

You will need the following:

• Okta and MCommunity configuration has been set up in your Mediaspace site.
• You are familiar with MCommunity.
• You are a KMC admin and are familiar with the KMS admin interface for your Mediaspace at yoursite/admin.

MCommunity Group(s) for User Management 

Understanding Mediaspace site roles

A Mediaspace site role is assigned to a user at login. When using Okta authentication with MCommunity groups, the site role assignment is automated. A user must only be a member in ONE associated MCommunity group.

• The typical Mediaspace configuration assigns the viewerOnly role to logged in users who are not members of any designated MCommunity group. This is called the defaultRole.
• When the defaultRole is disabled in the Saml module, only members of the configured MCommunity groups will have access to the site.
• In most cases the only roles mapped to MCommunity groups are unmoderatedAdminRole and privateOnlyRole, but in some cases may have multiple groups assigned to the same role. 
• The ITS-MiVideo support team has likely already added you to an MCommunity group mapped to the unmoderatedAdminRole.

In most cases you will add users to an MCommunity group mapped to either unmoderatedAdminRole or privateOnlyRole, but here are all Mediaspace roles and their capabilities:

• anonymousRole

  • The non-logged in user; they can view public content but can't interact with the site (upload, comment, create playlists, etc.).
  • If your site is locked down behind Okta, anonymous users can't access your site.

• viewerRole

  • Can view public channels/galleries.
  • Is not authorized to upload/create/publish content.
  • Does not have a My Media library.
  • Can be a channel member, but can't contribute content to channels.

• privateOnlyRole

  • Can upload content to a My Media library.
  • Can add/publish media to channels if given appropriate channel permissions (contributor or manager).
  • Can't publish to galleries.

• adminRole

  • Can upload content to a My Media library.
  • Can add/publish media to channels if given appropriate channel permissions (contributor or manager).
  • Can publish their own content to gallery categories.

• unmoderatedAdminRole

  • Same as adminRole plus bypass content moderation settings (when moderation is enabled).
  • Highest level of access on the Mediaspace frontend.

MCommunity group naming convention

• You should follow the established naming convention when creating groups specifically for your Mediaspace. It’s also ok to use existing MCommunity groups too.
• The group name is usually MiVideo {Mediaspace identifier} {Mediaspace Role}
  • For example:
    • MiVideo Staging unmoderatedAdminRole
    • MiVideo Staging privateOnlyRole

Tip: You can create multiple MCommunity groups all mapped to the same Mediaspace role, but users should only be a member of one group. Some admin may find this is a useful way to manage large numbers of MCommunity users.

1. Create MCommunity group(s) (skip if you are using an existing group)

1. Log in to https://mcommunity.umich.edu. 
2. Click My Groups.
3. At the top of the page, click Create Group.
4. Enter the group name following the naming convention (e.g. MiVideo Staging privateOnlyRole).
   1. Tip: Check your spelling. You cannot rename your groups. If you make a mistake you have to delete the group and start over
5. Create an email address for your group following your naming convention (e.g. mivideo-staging-privateonlyrole@umich.edu).
6. Enter a description to help you remember what function this group serves (e.g. “staging.mivideo.it.umich.edu mcommunity integration”). You can be as detailed as desired to remind you of the group’s purpose in your Mediaspace.
7. Click Continue.
8. Complete the form with these settings:
   1. Only owners can add members (default)
   2. Membership view - members only
   3. Messages can be sent to the group by - anyone (default)
9. Click Continue to add owner(s) and member(s).
   1. Your uniqname is automatically added as a group owner. If there are others who will manage the users in this group, add their uniqname(s) below yours.
   2. Important: Do not add yourself as a member UNLESS this is the role you should have when logging in to Mediaspace. Members should only belong to one MCommunity group. If you need to be a member in other groups, make sure the unModeratedAdmin group is mapped last in the SAML roleAttributes list.
   3. Add members (uniqnames) to the members text box.
10. Click Finish and wait for confirmation (it can take a few minutes).
11. At the top of the group page, copy the group name. You'll need it to request the group be associated with your Mediaspace.
12. Repeat to create all necessary groups.

2. Associate group(s) to Mediaspace

13. WIth the recent migration to new authenticate services, only ITS-MiVideo is now able to associate new groups with your Mediaspace. Please complete the ITS-MiVideo Support request.
14. When completing the request, you can select for ITS-MiVideo to configure these groups for you (step 3 below). Otherwise, wait until you hear back from ITS-MiVideo before completing step 3 below.

3. Add MCommunity group(s) to Mediaspace Saml module

15. Log in your KMS admin and click the Saml module.
16. Scroll down to the roleAttributes section. You may see the unmoderatedAdminRole config that was created by ITS MiVideo.
17. Click + Add “roleAttributes” at the bottom right of this section.
18. Paste the copied group name into the value field.
19. Copy/paste the attribute text from the unModeratedAdmin role or copy/paste from below. Tip: This value is the same for all groups you add. It's the Okta field that holds each user’s MCommunity group information:

edumember_ismemberof

23. Choose the appropriate role from the drop-down list (likely privateOnlyRole).
24. Repeat steps 20-24 for each MCommunity group you want to associate to a Mediaspace role. Every group must be first associated with the Mediaspace (step 2 above)..
25. Click Save at the bottom of the page.
26. Make sure the unModeratedAdmin group is at the end. This means you will probably need to add one more group, then copy/paste the unModeratedAdmin group settings from further up in the list. Once you’ve done that, you can delete the configuration that is higher up in the list.
27. Test the configuration:
    1. Have a group member login to the front end. 
    2. In the Mediaspace admin, click the Manage Users button and look for the group member in the list and verify they received the proper site role.

Use MCommunity Groups for Channel Membership and Media Collaboration

Requirements

• The Mediaspace site must be configured with Okta with MCommunity service entitlement.

Considerations

• A user’s role in Mediaspace is configured in the Saml module. 
• If the site has a default role of viewerRole and one MComm admin role configured and the authenticated user is not the AD group, they will get the viewerRole.
• viewerRole users cannot contribute to Mediaspace, so giving them a channel entitlement permission (other than member) or a media collaboration permission (other than co-viewer) will not override their Mediaspace role.
• If needed, configure additional MCommunity groups with the Saml module to set the user’s role to something other than the site’s default setting.

KMS Groups

KMS (Kaltura Mediaspace) groups are internal to your Mediaspace and managed by Kaltura. Once MCommunity groups are mapped to KMS groups, KMS groups can be used as a channel entitlement role for individual channels or a media collaborator for individual media.  All members of the group are given that role. For example, if a KMS group is added as a channel manager, all members of the group will have the ability to edit the channel and create channel playlists. Similarly, adding a KMS group as a co-editor on a video grants everyone in that group access to edit the video.

Users should be added/removed from MCommunity groups only. There is no need to manually update users in KMS groups. The next time a new or former member of the MCommunity group logs into the site, Kaltura will automatically add/remove the user from the mapped KMS group.

KMS Groups can be created automatically when the first user with the configured attribute in their Okta profile logs in, or you can create the group manually in the KMS admin. 

KMS automatic group creation

Automatic group creation occurs in the KMS when the first user with the configured Okta attribute in their profile logs in to KMS. 

1. If necessary, use an incognito window to login to the KMS as the user who is a group member.
2. You should get the “reaching out to database” message. 
3. After a successful login, validate by visiting Manage Groups in the KMS admin and adding the new group to a channel with the desired membership role.

KMS manual group creation

If it’s not practical or convenient to have a group member log in to trigger automatic group creation, you can manually add the KMS group in KMS Admin.

1. In the admin, go to Manage Groups > Add New Group button.
2. Enter a friendly Group Name (typically this is the name of the MCommunity group). Kaltura will generate a suggested Group ID. To accept this value, just tab through the field, otherwise you can create your own. Remember no special characters or spaces.
3. There’s no need to add members. The SAMLGroupSync module will take care of that for you when users log in. 
4. Click Add to save your changes.

1. Create MCommunity group(s) (skip if you are using an existing group)

1. If your MCommunity group doesn’t exist yet, create one for the channel members or media collaborators (see the Create An MCommunity group section steps 1-12 above). You can use the same group for both channel members and media collaborators. The group only needs configured in SamlGroupSync once. It’s recommended to give the group a meaningful name that includes the same prefix text to make it easy to find in MCommunity. You can use the description area to add context, which may be helpful for members when they are viewing the group info in Community.
   • For example LSA Mediaspace could have the following group:
     • Title: MiVideo LSA XYZ Channel Members
     • Description: lsa.mivideo.it.umich.edu XYZ Channel members
2. Make sure you add a test user or yourself to the group as a member in MCommunity so the configuration will process when you next login to Mediaspace. If you cannot add a user to the group, someone who is a member of the group will need to login after configuration to trigger the creation. 

2. Associate group(s) to Mediaspace

3. WIth the recent migration to new authenticate services, only ITS-MiVideo is now able to associate new groups with your Mediaspace. Please complete the ITS-MiVideo Support request.
4. When completing the request, you can select for ITS-MiVideo to configure these groups for you (step 3 below). Otherwise, wait until you hear back from ITS-MiVideo before completing step 3 below.

3. Add MCommunity group(s) to the SamlGroupSync module

5. In the Mediaspace admin, enable the SamlGroupSync module if not already and Save.
6. Click the + Add "attributes" button.
7. Copy/paste this line in the attribute box, taking care not to add any spaces.

edumember_ismemberof

8. Set the valueMappingType to Map attribute’s value to a group.
9. Click the + Add "valueMapping" button. 
10. Add the MCommunity group name in the value box.
11. Enter the KMS group name in the group box. If the KMS group already exists be sure to use the Group ID value in the group box. Otherwise create a new group name being certain not to use any spaces or special characters.

12. Repeat steps 6-11 for each MCommunity group you want to associate to a KMS group. 
13. Save.
14. Trigger group creation in Mediaspace if the KMS group doesn't already exist
    • If you are logged in to the front end of Mediaspace, either log out or open an incognito window.
    • Login or have another group member login. You/they should see a message about the database refreshing. This creates the KMS group and adds the user to the group.
    • If it’s not practical or convenient to have a group member login to trigger automatic group creation, you can manually create the KMS group in the Mediaspace admin.

4. Channel membership and media collaboration

15. Now that the group exists in Mediaspace:
    • Edit the channel and add the new group with the desired membership role.
    • Edit the media entry and add the new group with the desired collaboration role.

Mapping Groups to Okta Attributes

You can create groups from Pre-Approved Okta Attributes. For example, if you want to create a group of students only, you could use the eduPersonAffiliation attribute. To create a group limited to a particular campus use the eduPersonScopedAffliation attribute.

Edit the SamllGroupSync Module

1. Add the new Okta Attribute to the module.
   • Click the + Add "attributes" button. 
   • For example, to add the institution the person is affiliated with, use eduPersonScopedAffiliation
   • Make sure it’s set to Map attribute’s value to Group ID.
2. Add the valueMapping and group names.
   • Click the + Add "valueMapping" button. 
   • For eduPersonScopedAffiliation, the value mappings are like this (this is not an exhaustive list):

staff@annarbor.umich.edu (only AA staff, not faculty)
member@dearborn.umich.edu (any DBN affiliated user)
student@flint.umich.edu (only students affiliated with Flint)
affilaite@annarbor.edu (sponsored affiliate role at Ann Arbor)

3. Note that while a user can have multiple affiliations, each affiliation you want to use in your config must be individually mapped to the the desired group. For example, if you want to limit access to just Ann Arbor and Flint students, you’d create two group valueMappings, one student@annarbor.umich.edu and one for student@flint.umich.edu, each configured for the same group (e.g. “Ann Arbor and Flint Students”). 

Example config for Ann Arbor Staff. Note NO special characters or spaces in the Group name:

4. Save changes (be sure you get the Cache Cleared Message).

Add/Remove Members from MCommunity Group

You must be an owner of the group to add and remove other members. 

Owners have the ability to add owners and members. 

Members are those who get the unmoderatedAdmin role (or appropriate role) upon login. 

Someone can be both an owner and a member at the same time. As the owner you can manage the group and as a member you'll be an unmoderatedAdmin (or appropriate role) upon login.

A detailed guide to edit MComm groups can be found in this ITS document.

Nested MCommunity Groups

Access using nested (parent/child) MCommunity groups does not work with Okta. If you have a group with child groups, you’ll need to associate all the child groups if you also want to use those groups with the Mediaspace. Please complete the ITS-MiVideo Support request.

Resources and Questions

• Check out the Canvas and MiVideo tutorials

For additional questions, please contact the ITS Service Center