Chat with us, powered by LiveChat Skip to main content
Echo360 Status: 

EchoVideo: Configuring PingOne Authentication

Brockman Winfrey
  • Updated

PingOne is a cloud-based identity management system that provides secure authentication and integrated single sign-on (SSO) for EchoVideo.

Before You Begin

The PingOne integration offers the following single sign-on methods for customers:

  • Active Directory (requires AD Connect software from PingOne)
  • SAML Identity Providers
  • GoogleApps

Echo360 recommends that you select which option to implement in advance of performing the procedures on this page. To use Active Directory, understand that it requires software installation as noted above and that the system must reside outside the firewall.

IMPORTANT: EchoVideo does not yet allow for single sign-on authentication for the Windows PowerPoint ribbon add-on. The PPT Ribbon requires users to establish a direct login to EchoVideo. The user email remains the same (typically the institution or .edu email address) but users must establish a password within EchoVideo. This can be the same password as used for the SSO system or a different one. EchoVideo does support SSO for the Mobile App or Universal Capture (for instructors logging in to generate an ad hoc recording). For these applications, users are directed through the SSO authentication process with their institution's email address and password.

Workflow

The following workflow, and the instructions on this page, identify the steps necessary to set PingOne up to provide SSO services to EchoVideo through your network. For information on the subsequent steps needed to add and configure users to access EchoVideo content, see Configuring Authentication.

  1. Register for a PingOne account.
  2. Register the EchoVideo configuration with PingOne.
  3. Select the desired authentication method.
  4. Configure the authentication method in PingOne, and exchange the required metadata with the authentication source.
  5. Create or import the desired user accounts into EchoVideo.

Email addresses must match! EchoVideo uses email addresses as user identifiers; when creating users in EchoVideo, be SURE the email address for each user is the same as it is in the system through which they are being authenticated

When a user selects to open EchoVideo, the authentication request is sent through PingOne to the selected authentication system, then back to EchoVideo for access.

You may also want to review the procedures provided in Configuring PingOne for SSO-Enabled Section Access Links. The changes discussed in that article allow for a more appropriate flow of users accessing EchoVideo sections via postable URL links, and the authentication of those users as appropriate.

Creating PingOne account credentials

You must register in PingOne first and create your account credentials, then enable PingOne in EchoVideo.

BEFORE YOU BEGIN: Contact Echo30 Support for your Registration Code. Email support@echo360.com.

To register PingOne

  1. Go to https://admin.pingone.com/web-portal/register.
  2. Under Account Type, select PingOne for Enterprise.
  3. Under Profile setup, complete all details.

    NOTE: Your email address will become your username.

  4. In the Registration key field, enter the code provided by EchoVideo support.
  5. Enter and confirm your account password.
  6. Click Register.

After registering, you receive a confirmation email at the address entered on the form. Click the link in the email to complete the account registration process.

Configure authentication method in PingOne

PingOne needs to know which authentication method you want to use, and then you must configure that authentication method through PingOne.

The procedures below are provided as guidelines to the PingOne authentication setup process. Refer to the PingOne documentation (https://docs.pingidentity.com/r/en-us/pingoneforenterprise/p14e_connectingidp), or contact Echo360 support if you need further assistance.

Configuring SAML authentication

Configuring SAML authentication involves sharing identity key and certification information between PingOne and a SAML identity provider (IdP), allowing the two to communicate securely and provide appropriate user authentication.

To configure SAML authentication

  1. Log in to PingOne.
  2. Select the Setup tab.
  3. Select the appropriate SAML identity bridge.
  4. Click View/Edit.
  5. Select to Download the PingOne metadata to exchange with your identity provider (IdP). This tells PingOne to generate all of the necessary field parameters, then generates a downloadable file for you to upload into the IdP.
  6. Once you have uploaded the PingOne metadata and configured the IdP, you must enter the provider's configuration information back into PingOne. You have the following choices:
    • Upload a metadata file obtained from your identity provider into PingOne. This populates the PingOne configuration with the proper information from the provider.
    • Manually enter the appropriate field information. You may have received this data from the identity provider, or you may need to re-type the data into the corresponding fields for the identity provider.
  7. When finished, click Save Configuration.

Configuring Active Directory authentication

Using Active Directory (AD) authentication with PingOne requires that you have AD Connect installed and configured. You may also have IIS installed and configured but it is not required.

PingOne provides a download of the AD Connect installer to use if needed. The following information is copied from the PingOne documentation, regarding AD Connect requirements and Installation instructions for the provided installer. We recommend that you refer to the PingOne documentation in case there have been changes since this page was last updated. It is located at the following URL: https://docs.pingidentity.com/r/en-us/pingoneforenterprise/p14e_connect_azure

AD Connect requires the following:

  • One of the following platforms:
    • Microsoft Windows Server® 2012 R2
    • Microsoft Windows Server 2012
    • Microsoft Windows Server 2008 R2
    • Microsoft Windows Server 2008
  • Microsoft Net 4.5.2 Framework installed. The framework installation file is packaged with the AD Connect distribution.
  • Port requirements:
    • TCP 443 inbound/outbound (Websocket connections to PingOne)
    • (If IWA is enabled) TCP 80 internal, inbound/outbound (IWA connections)
  • Ensure that the Active Directory account lockout option is enabled for all PingOne users. This is necessary to protect user information in PingOne.
  • AD Connect does not support authentication using IWA with Office 365™ or mobile devices (IWA doesn't work with iOS).

You'll need to install AD Connect on a Windows Server host that resides in an Active Directory domain. When you download AD Connect from the PingOne admin portal, you'll either download to the Windows Server host or copy the AD Connect distribution to the host. If you are installing AD Connect on a host in a DMZ, you'll need to ensure some ports are open.

If you ARE using IIS along with AD Connect, refer to the PingOne documentation on how to Install AD Connect with IIS (https://docs.pingidentity.com/r/en-us/pingoneforenterprise/p14e_installing_adc_iis).

To install and configure IIS (optional)

NOTE: The installation instructions linked below are for Windows 2008 server with IIS 7.0. If you use a different operating version, find the Technet articles that relate to your specific supported environment.

  1. Install and Configure IIS: http://technet.microsoft.com/en-us/library/cc771209(WS.10).aspx
  2. Create a Certificate Request: http://technet.microsoft.com/en-us/library/cc732906(v=ws.10).aspx
  3. Complete the Certificate Request: http://technet.microsoft.com/en-us/library/cc771816(v=ws.10).aspx
  4. Import an existing certificate: http://technet.microsoft.com/en-us/library/cc732785(v=ws.10).aspx
  5. Add HTTPS protocol and port 443 binding to IIS: By default, IIS may not be configured to support the HTTPS protocol. To implement HTTPS on 443, follow these instructions to create the binding: http://technet.microsoft.com/en-us/library/cc771438(v=ws.10).aspx

To install and configure AD Connect

  1. Log on to your PingOne account.
  2. Download the AD Connect software.
  3. Extract the zipped file and launch the installation package by double-clicking the “run-as-administrator.cmd” file in the extracted folder.
  4. Click Next to proceed with the installation.
  5. (Optional) Select Full with IIS to install the full AD connect package in IIS. Only needed if you are using IIS.
  6. Click Next. The AD Connect installer checks that the prerequisites are in place. If all prerequisites are in place, the installation proceeds to the activation tab.
  7. The installer checks whether the appropriate version of the .Net framework is installed. If it is not, you can install it using the .Net distribution located in the AD Connect installation directory. When the .Net framework installation is complete, return to this AD Connect screen, and click Verify Install.
  8. Click Next. If you are using IIS, the installer then checks whether the IIS Server role is installed. If it isn't, install the role service using Windows Server Manager, return to this dialog, and click Verify Install to proceed.
  9. Click Next. If you are using IIS, the installer then checks whether the Windows Authentication role is installed for IIS. If it isn't, install the role service for IIS using Windows Server Manager, then return to this screen and click Verify Install to proceed.
  10. Click Next. The AD Connect activation screen appears. The Organization ID and the Product Key values are on the setup screen in PingOne.
  11. In the AD Connect activation screen, enter the Organization ID and Product Key, then click Activate and Next.

    NOTE: If the product is activated properly, you will see the following acknowledgment: “AD Connect has been activated”

  12. If applicable, select the IIS website that you want the AD Connect software installed to.
  13. Enter the installation location for the AD connect software and click Next.
  14. Click Install to complete the installation process of AD Connect.
  15. Click Finish to complete the installation process.

Enabling PingOne authentication in EchoVideo

To enable PingOne

Use a unique IDPID value. While the Identity Provider ID (IDPID) field can be any value you want if another PingOne client institution also uses EchoVideo has the same value, neither institution will be able to access EchoVideo. Furthermore, this value is challenging to change once established. Using a unique value at setup avoids having to address any conflict later.
The IDPID value is case-sensitive.

  1. Log on as an administrator.
  2. Select the Settings icon in the upper right of the screen.
  3. From the Settings menu, select Configurations.
  4. From the left panel, select PingOne configuration.
  5. In the Identify Provider ID field, enter a value that can be considered unique to your institution, such as your institution name, or preferably the institution domain being used for your identity provider (i.e., institutionName.edu).
  6. Click CONNECT TO PINGONE.
  7. A pop-up box appears on the screen with a checkbox. Click a check in this Enable Single-Sign on checkbox.
  8. A link to PingOne appears below the checkbox. Click this link.
  9. Log in to PingOne.
  10. Complete the PingOne application configuration by adding the proper identity bridge attribute for the application.
  11. Continue to Next Step, then add your institution Logo, Icon, Name, and Description as needed.
  12. When finished click Save and Publish.

Once PingOne is configured for EchoVideo, users can select to Log in with their school ID. See Configuring Authentication for the steps needed to allow users to access EchoVideo content through their institutional login.