Instead of only using the Picturepark IDS you can connect an OpenID Provider, which will serve as Identity Provider to the Picturepark IDS. The desired Identity Provider (IdP) must support the standardized Open ID Connect protocol, which itself allows a flexible implementation that varies in required metadata or ACR values.
Choose Identity Provider
The user opens Picturepark by providing the Picturepark URL. She chooses to log in with Picturepark IDS credentials by providing email and password (1). This will authenticate the user with Picturepark IDS as Identity Provider. If configured she can choose also another external identity provider (2) that will handle the authentication.
Create Identity Provider
You can configure one or many external Identity Providers for authentication.
Identity providers (short: IdP, IDP) are systems that manage and maintain identity information (e.g. user attributes). Identity providers offer user authentication as a service. Picturepark outsources the user authentication to the Picturepark Identity Server as the default trusted identity provider and is thus a relying party application to it. See Wikipedia Identity Provider.
Whenever Office 365 needs to verify a user, for example, Azure AD performs all identity and access management and is thus the trusted identity provider.
Prerequisites
ADFS setup (See How To setup ADFS on Windows Server 2016 here)
Your user must have "developer" permission in the Picturepark configuration to see this menu.
Your user role must have permission to manage Identity Provider.
Setup
Adding an external Identity Provider in Picturepark means adding it to the Picturepark IDS.
Setup an Identity Provider
Open Settings > IdP setup
In the list choose "Create new IdP"
Provide the details
Save
Newly created IdP's or changes made to existing ones could take around a minute to take effect.
Settings
Setting | Value Example | Description |
Name | PictureparkADFSWinServer2016 | A meaningful name that is used as a reference, it cannot be changed afterward. |
Display name | Picturepark AD | Something users can relate to, which is shown to the users next to "Continue with"  |
Type | ADFS |
This setting is currently not in use. It will be used to request different information per provider in one of the following releases. Ensure you choose the correct one already. |
Connection protocol | OpenID Connect | IdP must support OpenID Connect. |
URL | The Endpoint for OpenID with https.
Do not use the /ls endpoint. If your ADFS URL is https://adfs02.domain.com/adfs/ls then use the URL without /ls: https://adfs5684.domain.com/adfs. | |
Client ID | Application ID e.g. 9df5684-1f10f-4125684-7feb535684 | The ID of your application:  |
Client secret | GBAyfVL7YWtP6gudLIjbRZV_N0dW4f3x | This is not needed. You can leave this empty. The authentication flow is the definition of how the tokens to identify users are exchanged. Picturepark external Identity Provider must support Authorization Code Flow with PKCE. PKCE, pronounced “pixy” is an acronym for Proof Key for Code Exchange, which does not require users to provide a client_secret. The standard Authorization Code flow would require this. The main benefit is the reduced risk for native apps, as there are no embedded secrets in the source code and this in return limits exposure to reverse engineering. If the Identity Provider does not support Authorization Code Flow with PKCE, the Client secret can be used. Then the client secret must match the applications client secret. |
Sort order | 0 | A number, starting from 0 for the first position, and 1 as the second position. |
After Creating the Identity Provider
Create Identity Provider (Claim) Mappings
You can configure claim mappings and group mappings for your external Identity Provider.
Identity providers (short: IdP, IDP) are systems that manage and maintain identity information (e.g. user attributes). Identity providers offer user authentication as a service. Picturepark outsources the user authentication to the Picturepark Identity Server as the default trusted identity provider and is thus a relying party application to it. See Wikipedia Identity Provider.
Whenever Office 365 needs to verify a user, for example, Azure AD performs all identity and access management and is thus the trusted identity provider.
Prerequisites
Create Mappings
Open Settings > IdP Settings
Add claim mappings
Provide the claim name from your AD which holds the user attributes e.g. company, telephone number. Ensure the correct spelling!
Map to Picturepark user attributes
Add group mappings
Provide the claim name (issued claims) from your AD which holds your user group assignments e.g. Groups. Ensure the correct spelling!
Define a Fallback user role. The fallback user role of the IdP will only be used if none of the group mappings find a matching role or the default user role is not defined for the Picturepark. This cannot be Super Admins.
Map Group names from your AD to user roles in Picturepark.
Without group mappings, your users will be able to login to Picturepark but will have only the default role of your Picturepark assigned (if there is any configured). You cannot add roles to federated users in Picturepark, but only through group mappings.
There is a Microsoft limitation for ADFS 2.0 which prevents using Domain Local Groups in a claim. Choose global or universal groups. More details on this limitation: https://social.technet.microsoft.com/wiki/contents/articles/13829.ad-fs-2-0-domain-local-groups-in-a-claim.aspx
Automatic Claim Mappings
The following attributes are mapped automatically in CP (if not overridden by a claim mapping).
Further information about claims here: https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/technical-reference/the-role-of-claims
User attribute | Claim types (first to have a value wins) |
email, that will be used as a username in Picturepark (mandatory). | |
sub | User identifier of the user within the IdP (mandatory; provided by ADFS in basic configuration). |
First name | given_name |
Last name | family_name |
Language code |
locale |