SSO Login Setup

With Single Sign-On (SSO), a user can log in to multiple related services with a single username and password. For example, log in to a corporate portal and simultaneously get access to Kinescope. This simplifies access management and improves security.

Who this article is for

• Corporate system administrators — need to integrate Kinescope with an existing authentication system
• IT specialists — need to configure SSO via Keycloak or AD FS
• Corporate account owners — need to simplify employee access management
• Integration developers — need to set up single sign-on for users

Creating and configuring a client in Keycloak

1. To create a client in a new realm, go to “Clients” and click “Create client”.

2. Enter the client id (“Client ID”).

3. Click “Next”, select “Standard flow”, and enable “Client authentication”.

4. In the “Valid redirect URLs” field, enter https://app.kinescope.io/api/oauth2/callback/sso and click “Save” to save the client.

5. To create a client role, click “Clients” and select a client by ID or name from the list.

6. Go to the “Roles” tab and create the required role for the Kinescope user via “Create role”. For example, “kinescope-manager”.

7. Next, link the “kinescope-manager” role to the role in the connected system. From the “Roles” tab, click the created role to go to its details (“Role details”). In the “Associated roles” tab, click “Assign role”.

8. Filter the list by clients and select the desired role in “Associated roles”. Click “Assign” to confirm the link.

Users with the selected role in the system will now be created in Kinescope with the “kinescope-manager” role.

9. To complete setup, provide Kinescope support with the parameters: client_id, client_secret, and provider_url in the format https://{{keycloak-domain}}/realms/{{some_realm}}

If you encounter an error during setup or need consultation — the support chat within the Kinescope interface.

Setting up AD FS for Kinescope

Step 1: Creating an Application Group

1. Open the AD FS management console
2. In “Application Groups”, select “Add Application Group…”
3. In the Name field, enter a group name (e.g., “Kinescope”)
4. In the Description field, add a description (optional)
5. In the Template section, select “Server application accessing a web API” from the Client-Server applications list
6. Click Next to continue

Step 2: Configuring Server Application

1. Name will auto-fill as “Kinescope - Server application”
2. Client Identifier will be generated automatically (e.g., “123456789qwertyuiop”)
3. In the Redirect URI field, add the callback URL: https://app.kinescope.io/api/oauth2/callback/sso
4. Click Add to add the URI to the list
5. Click Next to continue

Step 3: Configuring credentials

1. Check the “Generate a shared secret” checkbox
2. The system will automatically generate a secret key (e.g., “WuxzhQ3yW1lsp_MbxY6M1KA1qbp81WvDNzieN”)

Important: Click the “Copy to clipboard” button to copy the secret. Save this secret in a secure place — you’ll need it to configure the integration.

3. Click Next

Step 4: Configuring Web API

1. Name will auto-fill as “Kinescope - Web API”
2. In the Identifier field, add the identifier (from step 2 - “123456789qwertyuiop”)
3. Click Add to add the identifier to the list
4. Click Next

Step 5: Configuring permissions (Client Permissions)

1. In the Applications table you’ll see:
2. • Server application (Ext_Kinescope - Server application)
   • Web API (Ext_Kinescope - Web API)
3. Select Web API from the list
4. Go to the Client Permissions tab

Step 6: Configuring permitted scopes

1. The Client Permissions tab shows current permissions
2. In Permitted scopes, checkboxes are set for required permissions:
3. • ✓ allatclaims
   • ✓ aza
   • ✓ email
   • ✓ openid
   • ✓ profile
4. To add new permissions, click Add Rule…

Step 7: Configuring Issuance Transform Rules

1. Go to the Issuance Transform Rules tab
2. The list shows existing rules:
   • Claims
   • Kinescope_manager (Role)
   • Kinescope_admin (Role)
   • Kinescope_viewer (Role)
3. To add a new rule, click Add Rule…
4. In the “Edit Rule - Claims” window that opens:
   • Claim rule name: enter “Claims”
   • Rule template: select “Send LDAP Attributes as Claims”
   • Attribute store: select “Active Directory”
   • Configure LDAP attribute mapping to outgoing claim types:
   • • E-Mail-Addresses → E-Mail Address
     • Display-Name → Name

Step 8: Adding a rule for the manager role

1. Click Add Rule… on the Issuance Transform Rules tab
2. Claim rule name: enter “Kinescope_manager”
3. Rule template: select “Send Group Membership as a Claim”
4. User’s group: specify the AD group “PYN\Kinescope_manager” (use Browse to search)
5. Outgoing claim type: select “Role”
6. Outgoing claim value: enter “kinescope-manager”
7. Click OK to save the rule

Step 9: Completing the setup

1. The Application Groups list shows the created group
2. To make changes, right-click the group and select “Add Application Group…” or “Properties”
3. Verify that all settings are saved correctly

What’s next?

After setting up SSO, we recommend:

1. Configure access rights — verify that user roles are configured correctly
2. Profile and workspace settings — workspace management
3. Organize your media library — create projects and folders to structure content
4. Set up content protection — restrict video access by domain or password

Still have questions? Write to the support chat within the Kinescope interface — our specialists will help!