Configuring MCommunity Groups to Work With MiVideo Mediaspace

Environment

MiVideo Mediaspace (KMS)

Issue

How can Mediaspace admins create and configure additional MCommunity groups as needed to make it easier to manage users?

• Use MCommunity Group(s) for User Management 
• Use MCommunity Groups for Channel Membership and Media Membership
• Mapping Groups to Shibboleth Attributes

Video Demos

Use MCommunity Groups for Mediaspace Roles

Use MCommunity Groups for Channel Entitlement

Resolution

Background

You will need the following to begin:

• Shibboleth and MCommunity configuration has been set up in your Mediaspace site and tested by the ITS-MiVideo support team
• You have been added as an owner of the “MiVideo SupportGroupsMaster” account for your Mediaspace by ITS-MiVideo (in MCommunity click My Groups and search for your MiVideo group in the list)
• You are familiar with MCommunity
• You are a KMC admin and are familiar with the KMS admin interface for your Mediaspace at yoursite/admin

MiVideo SupportGroupsMaster

This is a special MCommunity group that acts as the connection between Shibboleth (U-M Level 1 authentication) and your Mediaspace site. Your site’s MCommunity accounts must be added as members of this account (steps below). NEVER DELETE THIS ACCOUNT.

Use MCommunity Group(s) for User Management 

Understanding Mediaspace roles

A Mediaspace site role is assigned to a user at login. When using Shibboleth authentication with MCommunity groups, the site role assignment is automated. A user must only be a member in ONE associated MCommunity group.

• The typical configuration assigns the viewerOnly role to logged in users who are not members of a designated MCommunity group
• In most cases the only roles mapped to MCommunity groups are unmoderatedAdminRole and privateOnlyRole, but in some cases may have multiple groups assigned to the same role. 
• When the defaultRole is disabled in the Saml module, only members of the configured MCommunity groups will have access to the site.
• The ITS-MiVideo support team has likely already added you to an MCommunity group mapped to the unmoderatedAdminRole.

In most cases you will add users to an MCommunity group mapped to either the unmoderatedAdminRole or privateOnlyRole, but here are all the Mediaspace roles and their capabilities:

• anonymousRole

  • The non-logged in user; they can view public content but cannot interact with the site (upload, comment, create playlists, etc.)

• viewerRole

  • Can browse public galleries
  • Is not authorized to upload/create/publish content
  • Does not have a My Media page
  • Can be a channel member, but cannot contribute content to channels

• privateOnlyRole

  • Can upload content (My Media)
  • Cannot publish to galleries
  • Can add/publish media to channels if given appropriate channel permissions (contributor or manager)

• adminRole

  • Can upload content (My Media)
  • Can publish their own content to gallery categories
  • Can add/publish media to channels if given appropriate channel permissions (contributor or manager)

• unmoderatedAdminRole

  • Same as adminRole plus bypass content moderation settings (when moderation is enabled)

MCommunity group naming convention

• You should follow the established naming convention when creating groups specifically for your Mediaspace. However it’s also ok to use other established MCommunity groups.
• The group name is usually MiVideo {Mediaspace identifier} {Mediaspace Role}
  • For example the Staging Mediaspace groups are:
    • MiVideo Staging SupportGroupsMaster
    • MiVideo Staging unmoderatedAdminRole
    • MiVideo Staging privateOnlyRole

Tip: You can create multiple MCommunity groups all mapped to the same Mediaspace role, but users should only be a member of one group. Some admin may find this is a useful way to manage large numbers of MCommunity users.

1. Create an MCommunity group (skip if you are using an existing group)

1. Log in to https://mcommunity.umich.edu 
2. Click My Groups
3. Scroll the list and find your MiVideo SupportGroupsMaster account and make note of the Mediaspace identifier between “MiVideo” and “SupportGroupsMaster”
4. Back at the top of the page, click Create Group
5. Enter the group name following the naming convention (e.g. MiVideo Staging privateOnlyRole)
   1. Tip: Check your spelling. You cannot rename your groups. If you make a mistake you have to delete the group and start over
6. Create an email address for your group following your naming convention (e.g. mivideo-staging-privateonlyrole@umich.edu)
7. Enter a description to help you remember what function this group serves (e.g. “staging.mivideo.it.umich.edu mcommunity integration”). You can be as detailed as desired to remind you of the group’s purpose in your Mediaspace
8. Click Continue
9. Complete the form with these settings:
   1. Only owners can add members (default)
   2. Membership view - members only
   3. Messages can be sent to the group by - anyone (default)
10. Click Continue to add owner(s) and member(s)
    1. Your uniqname is automatically added as a group owner. If there are others who will manage the users in this group, add their uniqname(s) below yours
    2. Add members to the members text box (you must add at least one uniqname)

Important: Do NOT add yourself as a member UNLESS this is the role you should have when logging in to Mediaspace. Members should only belong to one MCommunity group. If you need to be a member in other groups, make sure the unModeratedAdmin group is the last one in the SAML roleAttributes list.

11. Click Finish and wait for confirmation (it can take a few minutes)
12. At the top of the group page, copy the group email address (NOT the request email address) so you can easily add it to the SupportGroupsMaster group
13. Click My Groups at the top of the page and click your MiVideo SupportGroupsMaster group (e.g. MiVideo Staging SupportGroupsMaster)
14. Click the Members tab
15. Click Add Members
16. Paste the copied email address into the Add Members box, then click Save Changes
17. You should now see your new group listed as a sub-account. Highlight this sub-account group name and copy it (not its URL) so you can easily add it to your Mediaspace SAML module

2. Add MCommunity group(s) to Mediaspace Saml module

18. Log in your KMS admin and click the Saml module
19. Scroll down to the roleAttributes section. You may see the unmoderatedAdminRole config that was created by the ITS MiVideo team
20. Click + Add “roleAttributes” at the bottom right of this section
21. Paste the copied group name into the value field
22. Copy/paste the attribute text from the unModeratedAdmin role or copy/paste from below. Tip: This value is the same for all groups you add. It is the Shibboleth field that holds each user’s MCommunity group information

urn:oid:2.16.840.1.113719.1.1.4.1.25

23. Choose the appropriate role from the drop-down list (likely privateOnlyRole)
24. Repeat steps 20-24 for each MCommunity group you want to associate to a Mediaspace role
25. Click Save at the bottom of the page
26. Make sure the unModeratedAdmin group is at the end. This means you will probably need to add one more group, then copy/paste the unModeratedAdmin group settings from further up in the list. Once you’ve done that, you can delete the configuration that is higher up in the list.
27. Test the configuration:
    1. Have a group member login to the front end 
    2. In the KMS admin, click the Manage Users button and look for the group member in the list and verify they received the proper site role

Use MCommunity Groups for Channel Membership and Media Collaboration

Requirements

• The Mediaspace site must be configured with U-M Weblogin (Level 1) with MCommunity service entitlement (this is the default setup for most non-UMHS Mediaspaces).

Considerations

• A user’s role in Mediaspace is configured in the Saml module. In this example, this site has a default role of viewerRole and one MCommunity admin role configured. If the authenticated user is not in the MCommunity group, they will get the viewerRole.

• viewerRole users cannot contribute to Mediaspace at all, so giving them a channel entitlement permission (other than member) or a media collaboration permission (other than co-viewer) will not override their Mediaspace role.
• If needed, configure additional MCommunity groups with the Saml module to set the user’s role to something other than the site’s default setting.

KMS Groups

KMS groups are internal to your Mediaspace and managed by Kaltura. Once MCommunity groups are mapped to KMS groups, KMS groups can be used as a channel entitlement role for individual channels or a media collaborator for individual media.  All members of the group are given that role. For example, if a KMS group is added as a channel manager, all members of the group will have the ability to edit the channel and create channel playlists. Similarly, adding a KMS group as a co-editor on a video grants everyone in that group access to edit the video.

Users should be added/removed from MCommunity groups only. There is no need to manually update users in KMS groups. The next time a new or former member of the MCommunity group logs into the site, Kaltura will automatically add/remove the user from the mapped KMS group.

KMS Groups can be created automatically when the first user with the configured attribute in their Shibboleth profile logs in, or you can create the group manually in the KMS admin. 

KMS automatic group creation

Automatic group creation occurs in the KMS when the first user with the configured Shibboleth attribute in their profile logs in to KMS. 

1. If necessary, use an incognito window to login to the KMS as the user who is a group member.
2. You should get the “reaching out to database” message. 
3. After a successful login, validate by visiting Manage Groups in the KMS admin and adding the new group to a channel with the desired membership role.

KMS manual group creation

If it’s not practical or convenient to have a group member log in to trigger automatic group creation, you can manually add the KMS group in KMS Admin.

1. In the admin, go to Manage Groups > Add New Group button.
2. Enter a friendly Group Name (typically this is the name of the MCommunity group). Kaltura will generate a suggested Group ID. To accept this value, just tab through the field, otherwise you can create your own. Remember no special characters or spaces.
3. There’s no need to add members. The SAMLGroupSync module will take care of that for you when users log in. 
4. Click Add to save your changes.

1. Enable the SamlGroupSync module (skip if already enabled)

1. In the KMS admin, enable the SamlGroupSync module.
2. Click the + Add "attributes" button
3. Copy/paste this line in the attribute box, taking care not to add any spaces.

urn:oid:2.16.840.1.113719.1.1.4.1.25

4. Set the valueMappingType to Map attribute’s value to a group.
5. Save the changes (you will come back to this in a minute). Verify you got the Cache Cleared message.

2. Configure KMS group

6. If your MCommunity group doesn’t exist yet, create one for the channel members or media collaborators (see the Create An MCommunity group section steps 1-17 above). You can use the same group for both channel members and media collaborators. The group only needs configured in SamlGroupSync once. It’s recommended to give the group a meaningful name that includes the same prefix text to make it easy to find in MCommunity. You can use the description area to add context, which may be helpful for members when they are viewing the group info in Community.
   • For example LSA-DSS Mediaspace could have the following group:
     • Title: MiVideo LSA-DSS XYZ Channel Members
     • Description: lsa-dss.mivideo.it.umich.edu XYZ Channel members
7. Make sure you add a test user or yourself to the group as a member in MCommunity so the configuration will process when you next login to Mediaspace. If you cannot add a user to the group, someone who is a member of the group will need to login after configuration to trigger the creation. 
8. Add the group as member to the site's SupportGroupsMaster group.
9. Go to the  SamlGroupSync module and click the + Add "valueMapping" button. 
10. Add the MCommunity group name in the value box.
11. Enter the KMS group name. If the KMS group already exists be sure to use the Group ID value in the group box. Otherwise create a new group name being certain not to use any spaces or special characters.

12. Repeat steps 9-11 for each MCommunity group you want to associate to a KMS group. 
13. Save
14. Trigger group creation in Mediaspace if the KMS group doesn't already exist
    • If you are logged in to the front end of Mediaspace, either log out or open an incognito window.
    • Login or have another group member login. You/they should see a message about the database refreshing. This creates the KMS group and adds the user to the group.
    • If it’s not practical or convenient to have a group member login to trigger automatic group creation, you can manually create the KMS group in the Mediaspace admin.
15. Now that the group exists in Mediaspace:
    • Edit the channel and add the new group with the desired membership role.
    • Edit the media entry and add the new group with the desired collaboration role.

Mapping Groups to Shibboleth Attributes

You can create groups from Pre-Approved Shibboleth Attributes. For example, if you want to create a group of students only, you could use the eduPersonAffiliation attribute. To create a group limited to a particular campus use the eduPersonScopedAffliation attribute.

Edit the SamllGroupSync Module

1. If not already present, add the new Shibboleth Attribute to the module. The Attribute’s value is the SAML2 value listed on the page linked above.

Example: eduPersonScopedAffilaation’s SAML2 attribute is urn:oid:1.3.6.1.4.1.5923.1.1.1.9

2. Make sure it’s set to Map attribute’s value to Group ID
3. Add the valueMapping and group names.

For eduPersonScopedAffiliation, the value mappings are like this (this is not an exhaustive list):
staff@annarbor.umich.edu (only AA staff, not faculty)
member@dearborn.umich.edu (any DBN affiliated user)
student@flint.umich.edu (only students affiliated with Flint)
affilaite@annarbor.edu (sponsored affiliate role at Ann Arbor)

4. Note that while a user can have multiple affiliations, each affiliation you want to use in your config must be individually mapped to the the desired group. For example, if you want to limit access to just Ann Arbor and Flint students, you’d create two group valueMappings, one student@annarbor.umich.edu and one for student@flint.umich.edu, each configured for the same group (e.g. “Ann Arbor and Flint Students”). 

Example config for Ann Arbor Staff. Note NO special characters or spaces in the Group name:

5. Save changes (be sure you get the Cache Cleared Message).

Additional Information

• Check out the Canvas and MiVideo tutorials

For additional questions, please contact the ITS Service Center