Configure Azure AD OAuth2 Single Sign-On (SSO)

Webcastcloud integration with Azure OAuth2 for Single Sign-On (SSO) allows users to seamlessly access the Webcastcloud platform using their Azure credentials. This knowledge base article provides step-by-step instructions on configuring Webcastcloud as a client application in Azure, with a specific focus on setting up the correct redirect URI.

Prerequisites: Before starting the configuration process, ensure that you have the following prerequisites:

• Azure Active Directory (AD) account with administrative privileges.
• Access to the Webcastcloud platform.

Create a New App Registration in Azure AD

1. Log in to the Azure Portal (https://portal.azure.com/).
2. Navigate to Azure Active Directory > App registrations > New registration
   
3. Complete the registration process
   • Name:  a friendly name for the application. ie. webcastcloudProd
   • Supported account types:
     • Accounts in the organizational directly only:  If you are using Azure and Webcastcloud for only users in your organization. ie. your staff or your members that have a user account hosted in Azure.
     • Accounts in any organizational directory and personal Microsoft accounts: If you are using Azure with Webcastcloud to allow any user globally to access your content library, with their Microsoft login account that is linked to a business/organization or their personal Microsoft account (ie, outlook.com, hotmail.com, live.com, etc)
     • Alternatively select Personal Microsoft Accounts only or Organizational Directory only, if you only want to support one of these.
       
   • Redirect URI, Select Web
   • Enter Redirect URI as  https://{site.webcastcloud.com}/azure/sso
     • If this is your production environment please use your video library hostname. This may be your whitelabel domain name. ie. https://{tv.website.com}/azure/sso
     • If you are using Azure along with another integration, such as Dynamics365, then your Redirect URI may be different. Please check with webcastcloud support.
       
   • Select Register
4. Note down the Tenant ID and Application (client) ID
5. Select Add a Certificate or Secret
6. Select + New client secret
   
   
7. Description:  Enter a name that the secret is being used for. ie. Webcastcloud
8. Expires: Set your organization's preferred expiration date. 
   Note, when the client secret expires, you will need to create a new secret and update this in Webcastcloud Admin again.
9. Click Add and Copy client secret, before navigating away from the page.
   Note: The secret will not be available to copy again
   
   
10. Click Endpoints from the top menu
    
11. Note the OAuth 2.0 authorization endpoint (v2) URL.
12. Note the OAuth 2.0 token endpoint (v2) URL.
    
    

Configure API Permissions for the Application 

1. Remaining in Azure App Registrations for the created Application 
2. Select API Permissions
   
   
3. Select Add a Permission
4. Select Microsoft Graph
5. Select Delegated Permissions
6. From OpenID permissions, select the following: email, openId, profile
   
   
   
7. Scroll down to User, and add the User permissions: User.Read, User.ReadBasic.All
   
   
8. Select Add Permissions

Configure Webcastcloud with Azure AD OAuth2 Details

1. Log in to the Webcastcloud Admin
2. Navigate to the Settings > Integrations
3. You can either use Microsoft Azure or OAuth as your Integration Setup. Please discuss with Webcastcloud Support if unsure of the best option for your organization.
   
   
4. Microsoft Azure 
   1. Select Edit
   2. Enter the Azure AD details copied in the steps above:
      • Directory (Tenant) ID
      • Client ID =  Application ID
      • Client Secret
      • Authorization Url
      • Token Url
   3. Save the changes
   4. Toggle ON the Azure Integration
      
      
5. OAuth2
   1. Select Edit
   2. Enter the Azure AD details copied in the steps above:
      • Directory (Tenant) ID -> Tenant ID
      • OAuth Authorization URL: For example; https://login.microsoftonline.com/common/oauth2/v2.0/authorize
      • OAuth Token URL: For example;
        https://login.microsoftonline.com/common/oauth2/v2.0/token 
      • Application (client) ID  -> Client ID
      • Client Secret -> Client Secret
      • User Info URL: For example;
        https://graph.microsoft.com/oidc/userinfo
      • Save
        
        
   3. Member Response Mapping:  You are now required to setup the User Info values that will be used to create the member profile in Webcastcloud.
      • An example of the user info response from Microsoft Graph is:
        
      • We now map these values to required member fields in Webcastcloud:
        
        • sub -> IntegrationUid
        • email - > Email
        • email - > Username
        • name - > FirstName
        • family_name - > LastName
          Note: these are the ideal minimum fields, although you can add other types if available.
          
      • Your mapping table may now look like this:
        

Step 6: Test the Configuration

1. Test the SSO functionality by logging in to Webcastcloud using your Microsoft credentials.

Conclusion: By following these steps, you can successfully configure Webcastcloud as a client application in Azure OAuth2 for Single Sign-On. Ensure that all details, including the redirect URI, are accurately configured to enable seamless authentication between Azure and Webcastcloud.

For assistance in troubleshooting, please contact Webcastcloud Support.