Working with Vizrt SSO (Keycloak)

To connect the Mosart Web Applications to a Vizrt SSO (for example, when running together with a Viz One authenticated by SSO), perform the following steps:

  1. Download the keycloak-mosart-sso.json file from the same folder that you got the installer on Vizrt’s download site.

  2. Log in to the Viz One SSO Admin pages, and go to the Import tab in the left menu.

  3. Click Select file and pick the keycloak-mosart-sso.json file.

  4. Review the options and when ready, click Import.

  5. Go to the Clients tab, find and open the VizMosart client that was just imported.

  6. Update the Root URL field with the fully-qualified domain name of the Mosart Web Applications server. The imported client arrives with the literal value https://REPLACE.ME:55143, so replace REPLACE.ME and keep the port that matches your setup: 55143 is the proxy's HTTPS port and 55142 its HTTP port. The client's Base URL is /showmaker/.

  7. Manage users and groups to assign the Mosart Web Application roles as desired. The roles are defined by the selected Client ID VizMosart, as shown in the screenshot. The imported configuration adds four client roles, showmaker-viewer, showmaker-admin, smartpanel-viewer and smartpanel-admin, together with four example groups, Showmaker Viewers, Showmaker Administrators, SmartPanel Viewers and SmartPanel Administrators. Use the groups as-is, customize them, or replace them with your own.

Info:

  • Groups do not directly grant permissions, they assign corresponding roles to all group members.

  • Roles grant user permissions.

  • showmaker-admin is a composite role that also grants showmaker-viewer, and smartpanel-admin likewise also grants smartpanel-viewer. The grant does not cross applications: a Showmaker administrator gets no Smart Panel permission, and a Smart Panel administrator gets none in Showmaker.

image-20250924-095921.png

Note: The imported configuration covers Showmaker and Smart Panel only. The Named Overlays Editor authorizes on mosart-admin and mosart-viewer, which are named after the capability rather than the app because Named Overlays and Smart Panel drive the same Viz Mosart Server endpoints. Neither role is in the file, so after importing it nobody is authorized in the Named Overlays Editor until you create those two roles on the VizMosart client and assign them.

  1. Use the Configuration Tool to configure OIDC settings for the target server.

    The settings are on the Server Configuration page, in the Authentication (OIDC) section. That section appears only when HTTPS is enabled with Certificates set to Custom certificate. With Automatic (built-in CA) there is no Authentication section, and authentication is not enforced. Manual proxy setup always uses a custom certificate, so the section appears there as soon as HTTPS is on.

    1. Issuer URL is typically the Viz One server's base URL followed by /auth/realms/Vizrt.

    2. Client ID must be VizMosart when using the imported configuration.

Tip: The Secret key can be obtained from the Vizrt SSO Administration console.

  • Select Clients > Credentials (tab).

  • Copy the value of Secret.