General

This page details configuration steps for OIDC providers.

The OpenID Connect Protocol (OIDC) is used to authenticate users. It can, in theory, be configured to integrate with any OIDC compliant identity provider.

The following providers have been tested and are supported:

  • Microsoft Entra ID (formerly Azure Active Directory)
  • Vizrt SSO (Keycloak)

Microsoft Entra ID

The Entra ID application configuration consists of two parts: an App Registration for the technical details of the application, and an Enterprise Application that defines user and group access and their role assignments, as well as other aspects of how the app integrates with your tenant.

Detailed Instructions

Complete instructions to set up the Entra ID App Registrations.

Introduction

This guide walks you through the steps to create and configure two App Registrations in your Microsoft Entra ID (Azure AD) tenant: "Vizrt Back-Ends" and "Vizrt MSE". These configurations allow your applications to use Entra ID for authentication and authorization.

When creating the registrations manually, both appId (Application Client ID) and id (Object ID) are auto-generated by Azure AD.

Step 1: Create the "Vizrt Back-Ends" App Registration

  1. Navigate to Azure Portal: Go to the Azure Portal and log in.

    1. Select your tenant that should be configured on the top right (user details) under Switch directory.

  2. Access Entra ID: Search for and select Azure Active Directory.

  3. Go to App Registrations: In the left-hand menu, under Manage, select App registrations.

  4. Create New Registration: Click on + New registration.

    • Name: Vizrt Back-Ends
    • Supported account types: Select Accounts in this organizational directory only (Single tenant).
    • Leave the Redirect URI (optional) section blank for now.
    • Click Register.

The registration name is free-form. This guide uses "Vizrt Back-Ends" as the example throughout; use whatever fits your naming convention.

If an application needs a client secret, create it in the same registration under Certificates & secrets > Client secrets > New client secret. Give it a description and an expiry that matches your rotation policy, then copy the value immediately — Entra shows it only once. Sign-in breaks when a secret lapses, so track the expiry date.

Step 2: Define App Roles for "Vizrt Back-Ends"

  1. In the "Vizrt Back-Ends" App Registration, navigate to App roles under Manage.

  2. Click on + Create app role. Create the following roles. Ensure the settings match exactly.

    1. For each role, click Apply after entering the details.

    Some role values of VAM-Messaging require the {APPCLIENTID} to be set to the application (client) ID as prefix. This can be retrieved from the app registration status page.

Role Display Name

Allowed member types

Value

Description

VAM-Storage Read/Write

User, Application

readwrite

VAM-Storage Read/Write

VAM-SERVICE

User, Application

vam

VAM-SERVICE

VAM-SERVICE Admin

User

vam-admin

VAM-SERVICE Admin

VAM-Messaging Write All

User, Application

{APPCLIENTID}.write:*/*/*

VAM-Messaging Write All

VAM-Messaging Read All

User, Application

{APPCLIENTID}.read:*/*/*

VAM-Messaging Read All

VAM-Messaging Configure All Vhosts

User, Application

{APPCLIENTID}.configure:*/*

RabbitMQ Configure All Vhosts

pilot-admin

User, Application

pilot-admin

Has administrator access to Viz Pilot Settings and all apps

graphic-designer

User, Application

graphic-designer

Can use Template Builder

pilot-editor

User, Application

pilot-editor

Can use Pilot Edge

pilot-journalist

User, Application

pilot-journalist

Can use Pilot Edge

pilot-mse

Application

pilot-mse

Used by the Media Sequencer Engine (MSE) to connect to Viz Pilot

VAM-Storage Admin UI

User

consoleAdmin

MinIO Admin UI

The VAM-Messaging roles authorize service-to-service messaging. The storage and message-broker administration consoles are not part of this configuration, so no browser sign-in is set up for them.

  1. Go to API permissions: In the left-hand menu, under Manage, select API permissions.

  2. Add Microsoft Graph Permissions:

    • Click + Add a permission.
    • Select Microsoft Graph.
    • Choose Delegated permissions.
    • Search for and select the following permissions: email, offline_access, openid, profile, and User.Read.
    • Click Add permissions.

  3. Add Vizrt Back-Ends Permissions:

    • Click + Add a permission.

    • Select the My APIs tab.

    • Find and click on Vizrt Back-Ends.

    • Choose Application permissions.

    • Search for and select the following permissions (the display names are in parentheses for easier identification):

      • {APPCLIENTID}.configure:*/* (VAM-Messaging Configure All Vhosts)
      • {APPCLIENTID}.read:*/*/* (VAM-Messaging Read All)
      • {APPCLIENTID}.write:*/*/* (VAM-Messaging Write All)
      • readwrite (VAM-Storage Read/Write)
      • vam (VAM-SERVICE)
      • pilot-mse (pilot-mse)

    • Click Add permissions.

  4. Grant Admin Consent: After adding all permissions, you will likely need to grant admin consent. Click the Grant admin consent button and then Yes. Ensure the status of all permissions changes to Granted.

API Permission

Permission Name

Type

Admin Consent Required

Microsoft Graph

email

Delegated

No

Microsoft Graph

offline_access

Delegated

No

Microsoft Graph

openid

Delegated

No

Microsoft Graph

profile

Delegated

No

Microsoft Graph

User.Read

Delegated

No

Vizrt Back-Ends

{APPCLIENTID}.configure:*/*

Application

Yes

Vizrt Back-Ends

{APPCLIENTID}.read:*/*/*

Application

Yes

Vizrt Back-Ends

{APPCLIENTID}.write:*/*/*

Application

Yes

Vizrt Back-Ends

readwrite (VAM-Storage Read/Write)

Application

Yes

Vizrt Back-Ends

vam (VAM-SERVICE)

Application

Yes

Vizrt Back-Ends

pilot-mse (pilot-mse)

Application

Yes

Step 3: Expose API for "Vizrt Back-Ends"

  1. In the "Vizrt Back-Ends" App Registration, navigate to Expose an API under Manage.
  2. Click Set next to Application ID URI.
  3. Accept the default api://{APPCLIENTID} and click Save.

Step 4: Configure Redirect URLs for "Vizrt Back-Ends"

  1. Open the newly created "Vizrt Back-Ends" App Registration.

  2. In the left-hand menu, under Manage, select Authentication.

  3. SPA Redirect URIs:

    • In the Single-page application (SPA) section, click Add a URI.

    • Add one URI per web application, replacing FQDN with the host name of your VAM installation:

      • https://FQDN:30443/config/
      • https://FQDN:30443/pilot/pcs-admin/
      • https://FQDN:30443/pilot/pilotedge/
      • https://FQDN:30443/pilot/template-builder/
      • https://FQDN:30443/pilot/data-server-config/

    • Click Save.

Entra matches a redirect URI exactly, including the trailing slash. Add one set of URIs for every host name users reach the installation by. Port 30443 is the gateway reached directly; omit the port when the installation sits behind a load balancer that terminates on 443.

Step 5: Create the "Vizrt MSE" App Registration

  1. Go to Azure Active Directory (Entra ID) then App registrations.

  2. Click + New registration.

    • Name: Vizrt MSE
    • Supported account types: Select Accounts in this organizational directory only (Single tenant).
    • Leave the Redirect URI (optional) section blank for now.
    • Click Register.

Step 6: Request API Permissions for "Vizrt MSE"

  1. In the "Vizrt MSE" App Registration, navigate to API permissions under Manage.
  2. Click on + Add a permission.
  3. Select the My APIs tab.
  4. Find and click on Vizrt Back-Ends.
  5. Under Application permissions, select the following roles:

Role Display Name

Role ID

Type

VAM-Storage Read/Write

<role-id>

Role

VAM-SERVICE

<role-id>

Role

pilot-mse

<role-id>

Role

pilot-admin

<role-id>

Role

graphic-designer

<role-id>

Role

pilot-editor

<role-id>

Role

pilot-journalist

<role-id>

Role

Role IDs are generated when a role is created, so they differ in every tenant and every app registration. Select the roles by display name in the portal; read the IDs from the App roles blade of "Vizrt Back-Ends", or from its Manifest, if you need them.

  1. Click Add permissions.
  2. Click the Grant admin consent button and then Yes. Ensure the status of all permissions changes to Granted.

Step 7: Assign Roles to Users/Groups for "Vizrt Back-Ends"

  1. Go to Azure Active Directory (Entra ID) then Enterprise applications.
  2. Find the Vizrt Back-Ends application.
  3. In the left-hand menu, under Manage, select Users and groups.
  4. Click on + Add user/group.
  5. Select the users or groups you want to grant access to.
  6. Under Select a role, choose the appropriate role or roles you defined in Step 2.
  7. Click Assign. Repeat this for all necessary user/group and role assignments.

Step 8: Enforce V2 JWT Tokens

  1. Go to Azure Active Directory (Entra ID) then App registrations.
  2. Open both the "Vizrt Back-Ends" and "Vizrt MSE" App Registrations.
  3. In the left-hand menu, under Manage, select Manifest.
  4. Find the "api" section in the JSON manifest.
  5. Ensure the "requestedAccessTokenVersion" property is set to 2. If it is not present, or is set to null or 1, change it to 2 and click Save.

Completing these steps configures your Entra ID App Registrations. Remember to configure your actual applications with their respective Application (client) IDs, any necessary client secrets, and the correct scope and audience information for authentication and authorization.