Authentication in Picturepark

The Picturepark Content Platform uses a secure authentication system build on Open ID Connect, which allows users to log in to one or multiple different Picturepark Content Platforms with the same Picturepark account, they already use with Picturepark. The Picturepark login is also the preferred method to connect your users with Picturepark Apps, Picturepark Microsites, or via direct user-centric API requests. 

Benefits of one Picturepark account for multiple platforms:

• One central user repository (Identity Provider) for authentication.

• Different permissions per platform role assignments. 

• Accessing multiple Picturepark platforms with the same account. 

• One login to connect them all, Picturepark apps and Picturepark Microsites and Picturepark customer systems. 

• Authentication using highly secure and flexible protocol Open ID Connect. 

• Easy administration and faster development cycles for new apps. 

Picturepark Identity Server (Picturepark IDS)

The Picturepark Content Platform serves the needs of multiple Picturepark customers, where separate user databases become an administrative and security nightmare. For the purpose of saving valuable IT resources Picturepark delegated user authentication and user provisioning to the Picturepark Identity Server (Picturepark IDS) as the default trusted Identity Provider (IdP), connected with Open ID Connect, the industry-standard protocol for secure and flexible authentication. The Picturepark IDS saves all user attributes required to authenticate users in one or multiple different Picturepark Content Platforms. 

Open

Copyright Image: Designed by gstudioimagen / Freepik

Picturepark IDS Scenario 

1. 💻 The user requests access to Picturepark via Login Form.

2. 🏢 The request is sent to the Picturepark IDS which verifies the identity. 

3. 🔑 The Picturepark IDS grants or denies access. 

Prerequisites

To configure the Picturepark IDS authentication, you need the following items: 

1. A Picturepark subscription. 

Configure and test

The Picturepark IDS authentication is inbuilt and needs no further configuration except the creation of a user, either via an administrator or via self-registration on the sign-up form. 

Open

Federated Authentication

Instead of only using the Picturepark IDS you can connect an OpenID Provider, which will serve as Identity Provider to the Picturepark IDS. The desired Identity Provider (IdP) must support the standardized Open ID Connect protocol, which itself allows a flexible implementation that varies in required metadata or ACR values. 

Benefits of adding an external Identity Provider (IdP): 

• Linking 3rd party accounts to your Picturepark Content Platform. 

• Connect to Picturepark quickly, seamlessly, and securely with an existing user account, e.g. from the company Active Directory or any trusted, in-place Identity Provider (IdP). 

• Add one or multiple supported Open ID Providers easily to your Picturepark. 

• Full control over permitted Identity Provider (IdP) on a user base, by adding the allowed IdP to the user, e.g. ADFS for employees only, Azure for agencies, and Picturepark IDS for all other users.

Copyright Image: Designed by gstudioimagen / Freepik

External IdP Scenario 

1. 💻 The user requests access to Picturepark via IdP button on Login Form, via "Connect via IdP" buttons. 

2. 🌍 Picturepark IDS sends the request to the configured Open ID Provider (IdP) which verifies the identity and sends the configured claims. 

3. 🔑 Picturepark CP authenticates the user. 

Prerequisites

To configure an Open ID provider, you need the following items: 

1. A Picturepark subscription. 

2. A supported Open ID Provider setup and configured, e.g. ADFS on Windows Server 2016. 

Limitations

1. You cannot remove roles from federated users when these roles were assigned from an IdP. Roles must be added to or removed from users via role mappings. 

2. Federated users cannot create API tokens.

3. Federated users cannot be Invited or set to be "In Review". 

4. The fallback user role of the IdP is only assigned when no role mapping finds a match and there is no default role. 

Further Information for External IdP

1. Picturepark Redirect URL is the URL of the Picturepark IDS + /signin-<Idp-id> 

   1. You can see the Picturepark IDS when you open the Login Form of your Picturepark in the URL. 

   2. You find the Identity Provider ID in the list of external IdP in Settings > IdP Setup

2. Client Secret is not needed as Picturepark uses the authorization code flow + PKCE.