Cisco Systems Home Theater Server 52x User Manual

Welcome [to DMS-Admin] 1-1

Concepts 1-1

Glossary 1-2

Procedures 1-2

Learn Your DMM Appliance Serial Number 1-2

Start DMS-Admin 1-3

Set a User Session Timeout for Components of Cisco DMS 1-5

Reference 1-6

FAQs and Troubleshooting 1-6

FAQs 1-6

DMS-Admin Dashboard 2-1

Concepts 2-1

Dashboard Overview 2-1

Understand the Alerts Gauge 2-2

Understand the System Information Gauge 2-3

Understand the Status Gauge 2-3

Understand the Licensed Features Gauge 2-4

Understand the Users Logged In Gauge 2-4

Procedures 2-4

View Dashboard Gauges 2-4

Licenses 3-1

Concepts 3-1

Understand Licenses 3-2

Procedures 3-2

Obtain License Keys 3-2

Install License Keys 3-3

View Installed Licenses 3-4

Check the Dashboard Gauge for Licenses 3-4

User Guide for Cisco Digital Media Manager 5.2.x

OL-15762-03

iii

Download from Www.Somanuals.com. All Manuals Search And Download.

Contents

Reference 3-4

Base Licenses for Cisco DMS Appliances and Endpoints 3-5

Optional Module Licenses 3-6

Server Operations 4-1

Procedures 4-1

Check Processes Remotely 4-1

Restart Appliances Remotely 4-2

Reference 4-3

Server Processes 4-3

Cisco Hinter for RTSP 5-1

Concepts 5-1

Overview 5-1

Workflow 5-2

Restrictions 5-3

Procedures 5-3

Download Cisco Hinter 5-4

Windows 5-4

Install Cisco Hinter on Windows 5-4

Run Cisco Hinter on Windows 5-5

Linux 5-5

Install Cisco Hinter on Linux 5-5

Run Cisco Hinter on Linux 5-5

Reference 5-6

FAQs and Troubleshooting 5-6

Troubleshoot RTP Over RTSP 5-6

Export the Root CA X.509 Certificate from Your Active Directory Server 6-22

Authentication and Federated Identity 6-1

Concepts 6-1

Overview 6-2

Glossary 6-2

Understand the Requirement to Authenticate Users 6-9

Decide Which Authentication Method to Use 6-10

LDAP and Active Directory Concepts 6-10

LDAP is Highly Complex 6-11

Plan Ahead 6-11

Restrictions 6-11

Synchronization Concepts 6-11

User Guide for Cisco Digital Media Manager 5.2.x

OL-15762-03

Download from Www.Somanuals.com. All Manuals Search And Download.

Contents

LDAP Concepts 6-14

Password Concepts 6-16

Understand Authentication Property Sheets for LDAP 6-16

Federated Identity and Single Sign-on (SSO) Concepts 6-17

IdP Requirements 6-17

Configuration Workflow to Activate Federation (SSO) Mode 6-17

Authentication Scenarios for User Sessions in Federation (SSO) Mode 6-18

Migration Between Authentication Methods 6-20

Understand Migration (from Either LDAP or SSO) to Embedded 6-20

Understand Migration (from Embedded) to Either LDAP or SSO 6-21

Procedures 6-21

Configure DMM to Trust the Active Directory Root CA 6-22

Choose an Authentication Method 6-23

Configure LDAP Settings 6-23

Define LDAP Filters 6-23

Define LDAP Bookmarks 6-24

Define the LDAP Synchronization Schedule 6-25

Manage LDAP Attributes 6-26

Configure the Settings for Automatic LDAP Synchronization 6-27

Derive LDAP Group Membership Dynamically from a Query 6-28

Configure Federation Services for SSO 6-29

Export an SP Configuration File from DMM 6-29

Import an IdP Configuration File into DMM 6-29

Bypass External Authentication During Superuser Login 6-30

Reference 6-31

Software UI and Field Reference Tables 6-31

Elements to Choose and Enable the Authentication Mode 6-31

Elements to Define, Validate, and Add LDAP Filters 6-34

Elements to Use LDAP Bookmarks for Synchronization 6-35

Elements to Schedule Synchronization 6-36

Elements to Manage Attributes 6-37

Sample SP Configuration File from DMM 6-38

Sample IdP Configuration Files 6-39

Exported IdP Configuration Sample from OpenAM 6-39

Exported IdP Configuration Sample from Shibboleth 6-40

FAQs and Troubleshooting 6-42

FAQs 6-42

User Guide for Cisco Digital Media Manager 5.2.x

OL-15762-03

Download from Www.Somanuals.com. All Manuals Search And Download.

Contents

Users and Groups 7-1

Concepts 7-1

Understand User Accounts 7-1

Understand User Roles 7-2

Procedures 7-2

Create User Groups 7-3

Delete User Groups 7-4

Create User Accounts 7-4

Assign Users to Groups 7-6

Edit User Accounts 7-6

Delete User Accounts 7-8

Assign User Access Rights and Permissions 7-8

Reference 7-9

Software UI and Field Reference Tables 7-9

Elements to Configure User Account Settings 7-9

FAQs and Troubleshooting 7-10

FAQs 7-10

Control DMPs and Presentation Systems

Events and Notifications 8-1

Concepts 8-1

Overview 8-2

Restrictions 8-2

Understand SNMP Concepts 8-3

Understand MIB and NMS Concepts 8-3

Understand IP Address Conflict Events 8-3

Understand Supported Event Types 8-4

Global Event Categories 8-4

DMP Event Categories 8-4

Show and Share Event Categories 8-4

Failover Cluster Event Categories 8-5

WAAS Event Categories 8-5

Understand Notification Methods 8-5

Workflow 8-5

Procedures 8-5

Enable or Disable Email 8-6

Configure SNMP Server Settings for Your DMM Appliance 8-6

Populate the MIB Browser in Your NMS 8-7

User Guide for Cisco Digital Media Manager 5.2.x

OL-15762-03

Download from Www.Somanuals.com. All Manuals Search And Download.

Contents

Configure Alert Reports and Notification Settings 8-7

Define Alert Report Parameters 8-7

Define Notification Rules 8-8

Reference 8-9

FAQs and Troubleshooting 8-9

FAQs 8-9

P A R T

Prepare a 40- or 52-inch Cisco LCD to Support Centralized Management through DVI 14-13

Welcome [to Centralized DMP Management] 9-1

Concepts 9-1

Overview 9-1

Procedures 9-2

Start Digital Signs 9-2

C H A P T E R 10

DMP Dashboard 10-1

Concepts 10-2

Overview 10-2

Understand the Media and Schedules Gauge 10-2

Understand the Left Side of the Media and Schedules Gauge 10-3

Understand the Digital Media Players Gauge 10-3

Understand the Cast Gauge 10-4

Understand the Settings Gauge 10-5

Procedures 10-5

View Dashboard Gauges for DMPs 10-5

Use the Left Side of the Media and Schedules Gauge 10-6

Use the Right Side of the Media and Schedules Gauge 10-7

Use the Digital Media Players Gauge 10-8

Use the Cast Gauge 10-8

Use the Settings Gauge 10-8

Reference 10-9

Software UI and Field Reference Tables 10-9

Elements on the Right Side of the Media and Schedules Gauge 10-9

C H A P T E R 11

Concepts 11-2

Overview 11-2

Glossary 11-2

User Guide for Cisco Digital Media Manager 5.2.x

OL-15762-03

vii

Download from Www.Somanuals.com. All Manuals Search And Download.

Contents

Partial Support for Cisco Medianet 2.1 Features 11-6

Understand Medianet Autoconfiguration for DMPs 11-7

Information That Medianet and DMPs Exchange 11-7

Medianet Activation Workflow for a DMP 4310G or 4400G 11-8

Restrictions 11-9

Guidelines 11-10

Limit Your Use of Manual Registration 11-10

General Best Practices for Non-Medianet Autoregistration 11-10

Best Practices to Schedule Non-Medianet Autoregistration Events 11-10

Understand the Sequence of Operations for Non-Medianet Autoregistration 11-11

Procedures 11-12

Use DMPDM to Prepare a DMP for Manual Registration 11-12

Use a System Task to Normalize DMP Passwords 11-13

Establish Trust Between Digital Signs and your Centrally Managed DMPs 11-14

Add or Edit Address Ranges for Non-Medianet Autoregistration 11-15

Delete Address Ranges for Non-Medianet Autoregistration 11-16

Add or Edit One DMP Manually 11-17

Delete DMPs Manually from Your Device Inventory 11-17

Reference 11-18

Software UI and Field Reference Tables 11-18

Elements to Autoregister DMPs 11-19

Elements to Add or Edit One DMP Manually 11-19

Elements to Delete One DMP Manually 11-20

Elements to Configure Non-Medianet Autoregistration 11-20

Prevent DHCP Address Assignments to the Wrong VLAN 11-21

FAQs and Troubleshooting 11-25

FAQs 11-25

C H A P T E R 12

Organize DMPs in Groups 12-1

Concepts 12-1

Overview 12-1

Understand the Effect of Nesting One DMP Group Inside Another 12-2

Procedures 12-3

Add and Edit DMP Groups 12-3

Delete DMP Groups 12-4

Add DMPs Manually to DMP Groups 12-4

Remove DMPs Manually from DMP Groups 12-5

Filter the DMP List Table 12-5

User Guide for Cisco Digital Media Manager 5.2.x

OL-15762-03

viii

Download from Www.Somanuals.com. All Manuals Search And Download.

Contents

Reference 12-6

Software UI and Field Reference Tables 12-6

Top-Level Elements to Manage DMPs and DMP Groups 12-6

Elements to Add or Edit DMP Groups 12-7

Elements to Delete DMP Groups 12-8

Elements to Add DMPs Manually to a DMP Group 12-8

Elements to Remove a DMP from a DMP Group 12-8

FAQs and Troubleshooting 12-9

FAQs 12-9

C H A P T E R 13

Configure DMP Wi-Fi Settings 13-1

Concepts 13-1

Glossary 13-1

ASCII Passphrases and Hexadecimal Keys for WEP 13-4

Workflow 13-4

Restrictions 13-5

Procedures 13-5

Establish a Wired Network Connection 13-5

Establish a Wireless Network Connection (802.11) 13-6

Reference 13-8

DMP Network Interfaces 13-8

FAQs and Troubleshooting 13-8

FAQs 13-8

C H A P T E R 14

Touchscreens, Projectors, and Displays 14-1

Concepts 14-1

Overview 14-2

Presentation System Concepts 14-3

Understand Which Displays Work Best with DMPs 14-3

Understand How to Choose Media Signal Cables 14-3

Understand and Prevent Image Retention (Burn-in) 14-6

Procedures 14-7

Connect to a Digital Display or Projector 14-7

Connect to a Touchscreen 14-8

Connect to an Analog Display or Projector 14-10

Prepare Equipment 14-11

Activate RS-232 Syntax Support for a 32-Inch Cisco LCD on a DMP 4400G 14-11

Activate RS-232 Syntax Support for a 40- or 52-inch Cisco LCD 14-11

Activate RS-232 Syntax Support for a 42- or 47-inch Cisco LCD 14-12

User Guide for Cisco Digital Media Manager 5.2.x

OL-15762-03

Download from Www.Somanuals.com. All Manuals Search And Download.

Contents

Activate RS-232 Syntax Support for DMTech Equipment 14-13

Activate RS-232 Syntax Support for NEC Presentation Systems 14-13

Activate or Deactivate HDMI Autodetection 14-14

Activate or Deactivate Resolution Autodetection 14-15

Configure and Manage Equipment 14-15

Define DMP Output Settings for Video and Audio 14-15

Edit DMP Output Settings for Video and Audio 14-16

Delete DMP Output Settings for Video and Audio 14-17

Use Simple Menus to Control Equipment That We Support Explicitly 14-18

Use RS232 Syntax to Control Equipment 14-20

Reference 14-22

Video and Audio Signal Interfaces 14-23

Supported Touchscreen Drivers 14-24

Software UI and Field Reference Tables 14-24

Elements to Choose Configuration Settings from Menus 14-24

Elements to Configure DMP Audio/Video Settings 14-27

Elements to Control HDMI Display Autodetection 14-27

Elements to Control Screen Resolution Autodetection 14-28

Elements to Activate RS-232 for Supported LCD Display Brands (except DMTech) 14-28

Elements to Activate RS-232 for LCD Displays by DMTech 14-28

RS-232 Command Reference for Cisco LCD Displays 14-29

FAQs and Troubleshooting 14-31

FAQs 14-31

Troubleshoot Cisco Professional Series LCD Displays 14-32

C H A P T E R 15

DMP Remote Control and Its Emulation 15-1

Concepts 15-1

Overview 15-1

Workflow to Provision Emulator Service for IP Phones 15-2

Procedures 15-3

Activate Services 15-3

Start Services 15-4

Configure URL Parameters 15-4

Enable IP Phone Autoregistration 15-5

Define IP Phone Service Attributes 15-5

Expose the Service to IP Phones 15-6

Configure Emulator Settings in Cast 15-7

Configure an IP Phone to Emulate the Remote Control 15-8

User Guide for Cisco Digital Media Manager 5.2.x

OL-15762-03

Download from Www.Somanuals.com. All Manuals Search And Download.

Contents

Start the Emulator on an IP Phone 15-9

Start the Emulator on a Mobile Phone 15-10

Use the Emulator on an IP Phone or a Mobile Phone 15-10

C H A P T E R 16

DMP User Permissions 16-1

Concepts 16-1

Overview 16-1

Scenarios That Illustrate Specialized User Permissions 16-2

Scenario 1: Permission to Manage Content but Not Schedules 16-2

Scenario 2: Permission to Manage One DMP Group but No Content 16-3

Scenario 3: Permission to Manage One DMP Group, Assets, and Schedules 16-5

Scenario 4: Permission to Manage Only the Schedule for One DMP Group 16-7

Procedures 16-8

Configure User Rights and Permissions 16-8

Reference 16-9

Software UI and Field Reference Tables 16-9

Elements to Configure User Rights and Permissions for DMPs 16-9

C H A P T E R 17

Media Assets and Embedded Software 17-1

Concepts 17-1

Overview 17-1

Restrictions 17-2

User Permission Restrictions 17-2

Media Restrictions 17-2

File Size Restrictions 17-3

Local Storage Restrictions 17-3

Procedures 17-4

Work with Assets and Categories in Your Media Library 17-4

Add One Asset at a Time to Your Media Library 17-4

Add Multiple Assets Simultaneously to Your Media Library 17-6

Reference 17-7

Software UI and Field Reference Tables 17-7

Elements to Manage Assets and Categories 17-7

Elements to Add Categories and Rename Them 17-9

Elements to Add Assets and Edit Their Attributes 17-10

Elements To Describe and Preview One Asset 17-11

User Guide for Cisco Digital Media Manager 5.2.x

OL-15762-03

Download from Www.Somanuals.com. All Manuals Search And Download.

Contents

C H A P T E R 18

Schedule Media to Play and Commands to Run 18-1

Concepts 18-1

Overview 18-1

Understand Future Deployments for Presentations 18-2

Understand Time Zones in the Schedule 18-2

Understand Tooltips in the Schedule Timeline 18-3

Understand Inline Status Messages for Deployed Events in the Schedule 18-3

Guidelines 18-3

Best Practices to Prevent Unscheduled DMP Restarts 18-3

Best Practices to Manage and Maintain the Schedule 18-3

Best Practices to Stop Playback of a Scheduled Job 18-4

Restrictions 18-4

External Server Restrictions 18-4

Content Delivery Network Restrictions 18-5

Scenarios 18-5

Methods to Pre-empt Only One Instance of a Recurring Event 18-5

Procedures 18-7

Use ‘Play Now’ to Transmit Assets or Commands Immediately 18-7

Use the ‘Run Task’ Feature to Transmit Assets or Commands Immediately 18-8

Schedule the Time Slot for a Future Event 18-8

Reference 18-10

Software UI and Field Reference Tables 18-10

Elements of a Tooltip in the Schedule Timeline 18-10

Elements to Describe the Status of Deployed Events 18-11

FAQs and Troubleshooting 18-12

FAQs 18-12

C H A P T E R 19

Content Distribution and Delivery 19-1

Concepts 19-1

Overview 19-1

Understand DMP Support for the CIFS Protocol 19-2

Choose a Content Delivery System to Use with DMPs 19-2

DMS-CD Concepts 19-3

DMS-CD Overview 19-4

Retry Timeout 19-4

Concurrent Deployments 19-4

DMS-CD Performance Factors 19-4

Understand Shared Scheduling Features for Deployments 19-6

Understand DMS-CD Alert Reports 19-6

User Guide for Cisco Digital Media Manager 5.2.x

OL-15762-03

xii

Download from Www.Somanuals.com. All Manuals Search And Download.

Contents

Guidelines 19-7

DMS-CD Guidelines 19-7

Restrictions 19-11

DMS-CD Restrictions 19-11

CIFS Restrictions 19-12

ACNS Restrictions 19-12

ECDS Restrictions 19-12

Example Scenario 19-13

Organizational Logic at Acme 19-13

Deployment Scheduling Logic at Acme 19-14

Procedures 19-15

Configure ACNS or WAAS 19-15

Configure DMS-CD 19-16

Configure Deployment Threshold Preferences 19-17

Check Disk Space Capacity for Deployments 19-17

Create a Deployment Package 19-18

Edit a Deployment Package 19-19

Delete a Deployment Package 19-20

Reference 19-21

Software UI and Field Label Reference Tables 19-21

Elements to Define Deployment Thresholds 19-21

Elements to Define a DMS-CD Deployment Package 19-24

Elements to Define WAAS, ACNS, or ECDS Settings 19-25

FAQs and Troubleshooting 19-27

Troubleshoot DMS-CD 19-27

FAQs for ACNS 19-30

FAQs for WAAS 19-30

Troubleshoot ACNS 19-30

P A R T

Communicate Anything with Cisco Digital Signs

C H A P T E R 20

Playlists 20-1

Concepts 20-1

Guidelines 20-1

Best Practices to Optimize DMP Settings for Playlists 20-1

Restrictions 20-2

User Guide for Cisco Digital Media Manager 5.2.x

OL-15762-03

xiii

Download from Www.Somanuals.com. All Manuals Search And Download.

Contents

Procedures 20-2

Create and Organize Playlists 20-2

Change the Sequence of Playback 20-3

Reference 20-3

Software UI and Field Reference Tables 20-3

Elements to Define a Playlist 20-3

C H A P T E R 21

Proof of Play 21-1

Concepts 21-1

Overview 21-1

Restrictions 21-2

Glossary 21-2

Insertions 21-2

Workflow 21-3

Procedures 21-3

Prepare DMPs to Support Proof of Play 21-3

Enable Syslog and NTP 21-4

Enable Proof of Play Features in DMM 21-5

Create Requestors 21-6

Create Insertions 21-6

Run a Report 21-7

Export a Report 21-8

View Previous Reports 21-9

Use the Proof of Play Dashboard 21-9

Use Deployment Reports 21-10

Reference 21-10

FAQs and Troubleshooting 21-10

FAQs 21-10

Troubleshooting 21-11

C H A P T E R 22

Plan for and Manage Emergencies 22-1

Concepts 22-1

Overview 22-1

Procedures 22-2

Create Deployment Packages for Emergencies 22-2

Provision Emergency Assets Immediately to DMP Local Storage 22-3

Use the ‘Run Task’ Feature to Provision Emergency Assets Immediately 22-3

Use the ‘Play Now’ Feature to Provision Emergency Assets Immediately 22-5

User Guide for Cisco Digital Media Manager 5.2.x

OL-15762-03

xiv

Download from Www.Somanuals.com. All Manuals Search And Download.

Contents

Schedule the Future Staging of Emergency Assets 22-6

Start Playback of an Emergency Message 22-7

Stop Playback of an Emergency Message 22-8

P A R T

Deliver IPTV Programming with Cisco Cast

C H A P T E R 23

Welcome [to Cisco Cast] 23-1

Concepts 23-1

Overview 23-1

Restrictions 23-2

Feature License Restrictions 23-2

Centralized Administration 23-2

On-Premises Operation 23-2

Workflow 23-2

Procedures 23-3

Start Cisco Cast 23-3

C H A P T E R 24

Redistribute Live TV 24-1

Concepts 24-1

Guidelines 24-2

Site Assessment for Live Video Programming 24-2

Restrictions 24-2

Channel Count Restrictions 24-2

Codec Restrictions 24-2

Procedures 24-2

Add Channels 24-3

Edit Channels 24-3

Reassign Channel Numbers 24-4

Delete Channels 24-5

List Only the Defined (Active) or Undefined (Inactive) TV Channels 24-5

Reference 24-6

Software UI and Field Reference Tables 24-6

Elements to Manage TV Channels 24-6

Elements to Define Channel Settings 24-8

User Guide for Cisco Digital Media Manager 5.2.x

OL-15762-03

Download from Www.Somanuals.com. All Manuals Search And Download.

Contents

C H A P T E R 25

Video on Demand 25-1

Concepts 25-1

Overview 25-1

Guidelines 25-2

Site Assessment for VoD Programming 25-2

Restrictions 25-2

Channel Count Restrictions 25-2

Workflow to Stage VoD Assets to DMP Local Storage 25-2

Procedures 25-3

Add a New VoD Category 25-3

Add a New VoD Subcategory 25-3

Edit a VoD Category 25-4

Delete a VoD Category 25-4

Map a Video to a VoD Category 25-5

Organize Videos in VoD Categories 25-6

Remove a Video from a Category 25-6

Stage an EPG to DMP Local Storage 25-6

Reference 25-7

Software UI and Field Reference Tables 25-7

Elements to Manage VoD Categories 25-7

C H A P T E R 26

Electronic Program Guide 26-1

Concepts 26-1

Overview 26-1

Guidelines 26-2

Understand EPG Data Formats 26-2

XMLTV 26-2

Tribune Media Services 26-2

Understand Methods to Describe EPG Channels 26-3

Procedures 26-5

Add or Edit Subscriptions to Data from an EPG Provider 26-5

Delete Settings That Define a Subscription 26-6

Synchronize EPG Channel Schedules and Program Descriptions 26-6

Reference 26-7

Software UI and Field Reference Tables 26-7

Elements to Define EPG Provider Settings 26-7

FAQs and Troubleshooting 26-8

Troubleshoot EPG Highlighting 26-8

User Guide for Cisco Digital Media Manager 5.2.x

OL-15762-03

xvi

Download from Www.Somanuals.com. All Manuals Search And Download.

Contents

C H A P T E R 27

Look and Feel 27-1

Concepts 27-1

Overview 27-1

Procedures 27-2

Choose the Color Scheme for Your Menu System 27-2

Specify Which Features Your Menu System Should Include 27-2

Show a Custom Logo in Your Menu System 27-3

Show the Cisco Logo in Your Menu System 27-4

Choose the Date and Time Formats for Your Menu System 27-4

Deploy Menu System Customizations to Your DMPs 27-5

User Guide for Cisco Digital Media Manager 5.2.x

OL-15762-03

xvii

Download from Www.Somanuals.com. All Manuals Search And Download.

Contents

User Guide for Cisco Digital Media Manager 5.2.x

OL-15762-03

xviii

Download from Www.Somanuals.com. All Manuals Search And Download.

A R T

Cisco Digital Media Suite Administration

Download from Www.Somanuals.com. All Manuals Search And Download.

C H A P T E R

Welcome [to DMS-Admin]

Revised: May 21, 2011

OL-15762-03

•

Concepts, page 1-1

Procedures, page 1-2

Reference, page 1-6

We prepared this material with specific expectations of you.

You will administer Cisco DMS.

Audience

Note

This material pertains to multiple releases of Cisco DMS.

5.2.0

5.2.1

5.2.2

5.2.3

Concepts

•

Glossary, page 1-2

User Guide for Cisco Digital Media Manager 5.2.x

OL-15762-03

1-1

Download from Www.Somanuals.com. All Manuals Search And Download.

Chapter 1 Welcome [to DMS-Admin]

Procedures

Glossary

Timesaver

Go to terms that start with... [

Appliance Administration Interface. Text-based, menu-driven user interface and command shell on all

AAI

Cisco DMS appliances. Administrators use AAI to set up, connect, and maintain an appliance.

Return to T o p

Digital Media Suite Administration. Web-based graphical user interface on a DMM appliance.

DMS-Admin

Administrators use DMS-Admin to:

•

Activate and monitor features throughout the full range of Cisco DMS products.

Exchange information with network entities outside Cisco DMS.

Centrally manage user accounts for Cisco DMS products.

Procedures

•

Learn Y o ur DMM Appliance Serial Number, page 1-2

Start DMS-Admin, page 1-3

Learn Your DMM Appliance Serial Number

Caution

You cannot obtain any Cisco DMS software feature licenses until you know your DMM appliance serial number.

Procedure

Step 1

Use SSH (or a keyboard connected your DMM appliance) to log in to the admin account in AAI.

Note

You alone know the password for this account.

User Guide for Cisco Digital Media Manager 5.2.x

OL-15762-03

1-2

Download from Www.Somanuals.com. All Manuals Search And Download.

Chapter 1 Welcome [to DMS-Admin]

Procedures

In the top-level menu for AAI, the SHOW_INFO option is highlighted by default.

Step 2

Press Enter to load the Show Info screen.

Step 3

Step 4

Write down the appliance serial number that AAI shows to you.

Stop. You have completed this procedure.

Start DMS-Admin

Procedure

Step 1

Point your browser at your DMM appliance.

•

Use HTTPS and specify port 8443

Use HTTP and specify port 8080—which redirects immediately to the secured HTTPS connection.

•

Be sure to use the fully qualified appliance DNS name and not merely its IP address.

For example, https://dmm.example.com:8443.

User Guide for Cisco Digital Media Manager 5.2.x

OL-15762-03

1-3

Download from Www.Somanuals.com. All Manuals Search And Download.

Chapter 1 Welcome [to DMS-Admin]

Procedures

Step 2

When the login page loads, sign in to your account.

Note

The appearance of the login screen can differ from this illustration. Its actual appearance depends on which Cisco DMS

software release you use and which user authentication method (embedded, LDAP, or federation) Cisco DMS uses in your network.

Step 3

Step 4

Click Log In.

Choose Administration from the global navigation or click Administration on the landing page.

User Guide for Cisco Digital Media Manager 5.2.x

OL-15762-03

1-4

Download from Www.Somanuals.com. All Manuals Search And Download.

Chapter 1 Welcome [to DMS-Admin]

Procedures

What happens next depends on what happened before.

No licenses are installed.

•

Is your

appliance

factory-new or

recently

We take you first to the page where you can install a license key.

restored?

At least one license is installed.

•

Have you

activated even

one licensed

feature?

We take you first to the DMS-Admin Dashboard, whose gauges can inform you

at a glance.

Step 5

Stop. You have completed this procedure.

Related Topics

•

Chapter 2, “DMS-Admin Dashboard”

Chapter 3, “Licenses”

Set a User Session Timeout for Components of Cisco DMS

We log inactive users out of their sessions automatically after an interval, which you set, has elapsed.

This interval applies to all users without exception.

Procedure

Step 1

Choose Administration > Security > Session.

Step 2

Step 3

Step 4

Use the Session Timeout (in minutes) field to enter or edit a session timeout value.

Click Update.

Stop. You have completed this procedure.

User Guide for Cisco Digital Media Manager 5.2.x

OL-15762-03

1-5

Download from Www.Somanuals.com. All Manuals Search And Download.

Chapter 1 Welcome [to DMS-Admin]

Reference

•

FAQs and Troubleshooting, page 1-6

FAQs and Troubleshooting

•

FAQs, page 1-6

FAQs

Q. What might prevent me from logging in?

A. Check the following, and then try again to log in.

•

Is your username wrong or mistyped?

Is your password wrong, mistyped, or expired?

Is your user account suspended?

Is your user account locked after too many failed login attempts?

User Guide for Cisco Digital Media Manager 5.2.x

OL-15762-03

1-6

Download from Www.Somanuals.com. All Manuals Search And Download.

C H A P T E R

DMS-Admin Dashboard

Revised: May 21, 2011

OL-15762-03

•

Concepts, page 2-1

Procedures, page 2-4

We prepared this material with specific expectations of you.

You will administer Cisco DMS.

Audience

Note

You have already installed at least the license key to activate one Cisco DMS software feature module.

This material pertains to multiple releases of Cisco DMS.

5.2.0

5.2.1

5.2.2

5.2.3

Concepts

•

Dashboard Overview, page 2-1

Dashboard Overview

The dashboard for DMS-Admin centralizes many features for system monitoring and log collection.

When problems of any kind interfere with the data-collection processes that populate its gauges, they

show question marks in addition to the best available data. In this case, check that your systems and

network are configured and working correctly.

User Guide for Cisco Digital Media Manager 5.2.x

OL-15762-03

2-1

Download from Www.Somanuals.com. All Manuals Search And Download.

Chapter 2 DMS-Admin Dashboard

Concepts

These are the dashboard gauges.

NEW IN CISCO DMS RELEASE 5.2.3—The Failover Cluster gauge monitors your use, if any, of failover.

Note

Sometimes, a monitoring gauge might leave out a value that you expect it to show. When this occurs, we mark any missing

values with a placeholder symbol ( ) to indicate which values we could not show.

Tip

Until you install at least one license key, the DMS-Admin dashboard cannot retrieve data to populate its gauges.

Understand the Alerts Gauge

This gauge shows the total count of notification messages delivered in the past 1 hour.

Timesaver

Click View Alerts to open the Alerts page.

User Guide for Cisco Digital Media Manager 5.2.x

OL-15762-03

2-2

Download from Www.Somanuals.com. All Manuals Search And Download.

Chapter 2 DMS-Admin Dashboard

Concepts

Understand the System Information Gauge

The System Information gauge:

•

Tells you the installed release version of your DMM server software.

Tells you the serial number of your DMM appliance.

Measures free space and used space for:

–

The content partition on your DMM appliance hard drive.

The content partition on your Show and Share appliance hard drive.

Understand the Status Gauge

Tip

Refresh your browser to update the data that this gauge shows.

Have you set up the hardware and activated the separately licensed software features for server failover,

Show and Share, and your DMPs?

If so, this gauge summarizes their current state in three summaries, side-by-side.

Digital Media Players

•

Counts the total number of registered DMPs.

Specifies how many DMPs were reachable or unreachable when this gauge loaded in your browser.

Show and Share

Appliance

•

States whether your Show and Share appliance was unreachable at any time in the past 1 hour.

(This release supports your use of only one Show and Share appliance.)

Counts the number of Show and Share publishing operations that were pending or completed when

this gauge loaded in your browser.

Failover Cluster

•

NEW IN CISCO DMS 5.2.3—Indicates the status of Cisco DMS appliances in your failover cluster.

User Guide for Cisco Digital Media Manager 5.2.x

OL-15762-03

2-3

Download from Www.Somanuals.com. All Manuals Search And Download.

Chapter 2 DMS-Admin Dashboard

Procedures

Timesaver

Click...

•

View All DMPs and DMP Groups to open the DMP Manager page.

Go to Show and Share to open Show and Share.

Manage Show and Share to open Show and Share Administration.

View Failover Status to open the Failover Configuration page.

Understand the Licensed Features Gauge

This gauge lists software feature module licenses that are installed on your DMM appliance and

describes constraints that your licenses impose.

Understand the Users Logged In Gauge

Counts the total number of users who logged in to your Cisco DMS appliances over the past 1 hour.

Timesaver

Click View All Users to open the Users page in DMS-Admin.

Procedures

•

View Dashboard Gauges, page 2-4

View Dashboard Gauges

Procedure

Step 1

Step 2

Click the Dashboard tab.

Stop. You have completed this procedure.

User Guide for Cisco Digital Media Manager 5.2.x

OL-15762-03

2-4

Download from Www.Somanuals.com. All Manuals Search And Download.

C H A P T E R

Licenses

Revised: May 21, 2011

OL-15762-03

•

Concepts, page 3-1

Procedures, page 3-2

Reference, page 3-4

We prepared this material with specific expectations of you.

You will administer Cisco DMS.

Audience

Note

You have already purchased at least the license key to activate one Cisco DMS software feature module.

This material pertains to multiple releases of Cisco DMS.

5.2.0

5.2.1

5.2.2

5.2.3

Concepts

•

Understand Licenses, page 3-2

User Guide for Cisco Digital Media Manager 5.2.x

OL-15762-03

3-1

Download from Www.Somanuals.com. All Manuals Search And Download.

Chapter 3 Licenses

Procedures

Understand Licenses

Features of Cisco DMS are licensed and activated separately. Until you obtain and install license keys,

their corresponding features are hidden from all users—including you, the administrator.

Note

Even then, some features remain hidden from users whose privilege levels are low.

What to Do Next

•

OPTIONAL—Would you like to learn which feature licenses we sell?

See http://www.cisco.com/go/dms.

MANDATORY—Would you like to obtain license keys?

Proceed to the “Obtain License Keys” section on page 3-2.

MANDATORY—Would you like to install feature licenses?

Proceed to the “Install License Keys” section on page 3-3.

Procedures

•

Obtain License Keys, page 3-2

Install License Keys, page 3-3

View Installed Licenses, page 3-4

Check the Dashboard Gauge for Licenses, page 3-4

Obtain License Keys

Before You Begin

Obtain the serial number for your DMM appliance.

•

Procedure

Step 1

Compose an email message that includes or identifies all of the following.

•

All Cisco sales order numbers that were associated with your Cisco DMS purchase (such as,

appliances, software modules for DMM, and DMPs), including even the sales order numbers for all

purchased products and services that are not components of Cisco DMS.

•

Your DMM appliance serial number.

Your email address.

The name of your organization.

The department name within your organization.

The DMM software feature module (or modules) that you purchased.

Did you purchase DMM software feature modules for Cisco Digital Signs or Cisco Cast? If so,

include the number of DMPs that you will manage centrally.

Step 2

Send the email message to [email protected].

User Guide for Cisco Digital Media Manager 5.2.x

OL-15762-03

3-2

Download from Www.Somanuals.com. All Manuals Search And Download.

Chapter 3 Licenses

Procedures

Step 3

Step 4

After you receive a license key file from Cisco, save a local copy of it.

Stop. You have completed this procedure.

What to Do Next

•

MANDATORY—Install License Keys, page 3-3

Related Topics

•

Learn Y o ur DMM Appliance Serial Number, page 1-2

View Installed Licenses, page 3-4

Install License Keys

Procedure

Step 1

Step 2

Step 3

Step 4

Step 5

Step 6

Step 7

Start DMS-Admin.

Choose Licensing > Install/Upgrade Licensing.

Click Browse or Choose File, depending on your installed browser.

Find and click the license file where you saved it.

Click Open.

Click Install License.

Repeat these steps until all of your licenses are installed.

Features that you licensed are now activated.

Stop. You have completed this procedure.

Step 8

Related Topics

•

Start DMS-Admin, page 1-3

View Installed Licenses, page 3-4

User Guide for Cisco Digital Media Manager 5.2.x

OL-15762-03

3-3

Download from Www.Somanuals.com. All Manuals Search And Download.

Chapter 3 Licenses

Reference

View Installed Licenses

Before You Begin

•

Install license keys.

Procedure

Step 1

Step 2

Step 3

Start DMS-Admin.

Choose Licensing > View Licensing.

Stop. You have completed this procedure.

Tip

The License Features gauge on the DMS-Admin dashboard summarizes this information.

Related Topics

•

Start DMS-Admin, page 1-3

Install License Keys, page 3-3

Check the Dashboard Gauge for Licenses

Before You Begin

•

Install license keys.

Procedure

Step 1

Step 2

Step 3

Start DMS-Admin.

Choose Administration > Dashboard.

Check the License Features gauge.

It tells you which of your:

•

Licensed features are activated.

Feature licenses impose restrictions.

Step 4

Stop. You have completed this procedure.

Reference

•

Base Licenses for Cisco DMS Appliances and Endpoints, page 3-5

Optional Module Licenses, page 3-6

User Guide for Cisco Digital Media Manager 5.2.x

OL-15762-03

3-4

Download from Www.Somanuals.com. All Manuals Search And Download.

Chapter 3 Licenses

Reference

Base Licenses for Cisco DMS Appliances and Endpoints

We include a base license at no additional cost with the purchase of any Cisco DMS appliance or

endpoint. These licenses are unit-specific and perpetual. We do not impose any non-support fees and do

not obligate you to purchase other licenses.

DMM appliance

With a DMM appliance base license, you can:

•

Install feature licenses for components of Cisco DMS¹.

Gain access to features after you license them.

Create user accounts and user groups for components of Cisco DMS¹.

Configure a user authentication framework for use throughout Cisco DMS¹.

Configure event notifications and alarms for components of Cisco DMS¹.

Check processes remotely.

Monitor and restart servers remotely¹.

Show and Share

appliance

With a Show and Share appliance base license (and a DMM appliance), you can set up a

Show and Share site.

•

Authors: 5

Viewers: Unlimited

Category managers: Unlimited

Related Topics

•

LDAP and Active Directory Concepts, page 6-10

Federated Identity and Single Sign-on (SSO) Concepts, page 6-17

User Guide for Cisco Digital Media Manager 5.2.x

OL-15762-03

6-9

Download from Www.Somanuals.com. All Manuals Search And Download.

Chapter 6 Authentication and Federated Identity

Concepts

Decide Which Authentication Method to Use

LDAP and Active Directory Concepts

•

LDAP is Highly Complex, page 6-11

Plan Ahead, page 6-11

Restrictions, page 6-11

Synchronization Concepts, page 6-11

LDAP Concepts, page 6-14

Password Concepts, page 6-16

Understand Authentication Property Sheets for LDA P , p age 6-16

User Guide for Cisco Digital Media Manager 5.2.x

OL-15762-03

6-10

Download from Www.Somanuals.com. All Manuals Search And Download.

Chapter 6 Authentication and Federated Identity

Concepts

LDAP is Highly Complex

Caution

LDAP-related features of Cisco DMS are meant for use by qualified and experienced administrators of

Microsoft Active Directory. Unless you are an Active Directory and LDAP expert, we recommend that you use

embedded authentication.

Plan Ahead

•

Install and configure Active Directory and Internet Information Services (IIS) before you try to

configure LDAP authentication mode or federation mode in DMS-Admin.

Tip

•

We support IIS 6 on Windows Server 2003.

Pair your DMM appliance and your Show and Share appliance in AAI before you configure

Cisco DMS to use LDAP authentication. Otherwise, video tutorials for Show and Share are not

loaded onto your Show and Share appliance.

•

Make sure that you have generated or imported certificates as necessary and activated SSL on the

Active Directory server before you try to configure SSL encryption.

Restrictions

Support for

Active Directory

Cisco DMS Release

Trees

Forests

5.2.0

Yes

5.2.1

5.2.2

5.2.3

Yes

Synchronization Concepts

•

Synchronization (Replication) Overview, page 6-12

Synchronization Types, page 6-12

Understand Manual Synchronization, page 6-13

Understand Automatic Synchronization, page 6-13

Guidelines for Synchronization, page 6-14

User Guide for Cisco Digital Media Manager 5.2.x

OL-15762-03

6-11

Download from Www.Somanuals.com. All Manuals Search And Download.

Chapter 6 Authentication and Federated Identity

Concepts

Synchronization (Replication) Overview

When you choose LDAP authentication or SSO authentication, user account data originates from your

Active Directory server. However, Cisco DMS does not synchronize (replicate) this data automatically,

in real time. Instead, we cache it. Therefore, you must resynchronize user account data when you think

it is appropriate to do so. You can:

•

Resynchronize manually.

Schedule synchronizations to recur in the future at set intervals.

Note

Features of Digital Signs and Show and Share Administration help you to manage user access

privileges and permissions for Cisco DMS.

DMS-Admin synchronizes all user accounts in the Active Directory “user base” that your filter specifies,

except users whose accounts are disabled on your Active Directory server.

Synchronization Types

We support four types of Active Directory synchronization in LDAP mode or federation mode.

Initial

Update

Overwrite

Delete

Runs a one-time

synchronization for a

Runs an incremental,

fast update to find and copy of user accounts

Overwrites your local

Deletes your local copy

of user accounts that

new filter that you never make up for any

that correspond to your correspond to a defined

Active Directory filter Active Directory filter

synchronized

previously.

differences between

user accounts that

match your

with new copies of

and deletes the entry for

those user accounts. In that filter from

Active Directory filter addition, deletes your

and your local copy of local copy of each user

DMS-Admin.

those user accounts.

account that has been

deleted from

Active Directory since

the last time that you ran

a synchronization.

User Guide for Cisco Digital Media Manager 5.2.x

OL-15762-03

6-12

Download from Www.Somanuals.com. All Manuals Search And Download.

Chapter 6 Authentication and Federated Identity

Concepts

Understand Synchronization of a DMM Group to an LDAP Filter

NEW IN CISCO DMS 5.2.1

Is the Active Directory Filter

Associated to a DMM

User Group?

We Sync All Matching LDAP User Accounts to the

‘All Users’ Group in DMM

Associated User Group in DMM

Yes

N.A.

•

In most cases, you can associate one LDAP filter apiece to one DMM user group. Likewise, in most

cases, you can associate one DMM user group apiece to one LDAP filter. The Digital Signs user

group is an exception to both of these principles. It is built-in to Cisco DMS.

After you associate a DMM user group to an LDAP filter, you cannot use features on the Users tab

to delete the DMM user group until after you delete the LDAP filter. However, even when you delete

an LDAP filter, there is no requirement to delete its associated DMM user group. Furthermore,

there is no way for you to delete the Digital Signs user group. It is built-in to Cisco DMS.

Understand Manual Synchronization

Manual synchronization mode requires you to choose Administration > Settings > Authentication >

Synchronize Users > LDAP Bookmarks during all future synchronizations. Afterward, you must

click Update.

Note

Manual synchronization mode deletes your schedule for automatic synchronizations.

Understand Automatic Synchronization

Automatic synchronization mode automates and schedules incremental updates to user accounts that

match Active Directory filters that you defined in DMS-Admin. When you use automatic

synchronization mode, new fields and elements become available to you. These help you to configure

the settings for automatic synchronization.

Tip

See the “Understand Synchronization of a DMM Group to an LDAP Filter” section on page 6-13.

User Guide for Cisco Digital Media Manager 5.2.x

OL-15762-03

6-13

Download from Www.Somanuals.com. All Manuals Search And Download.

Chapter 6 Authentication and Federated Identity

Concepts

Guidelines for Synchronization

We recommend that you synchronize your LDAP bookmarks periodically. Synchronization ensures that

user and group membership associations are current and correct.

Sync

Type

Best Practices

Initial

The Initial option is CPU-intensive for your DMM appliance and might lower performance

temporarily. We recommend that you use it during off-peak hours only.

Update

We recommend that you use the Update option whenever:

•

A new user account in Active Directory should have login access to DMM or

Show and Share.

User attributes¹change in Active Directory for a user account in DMM or

Show and Share.

A user account is disabled in Active Directory and should be deleted from DMM

and Show and Share.

Overwrite Note

The Overwrite option is CPU-intensive for your DMM appliance and might lower its

performance temporarily. We recommend that you use this option during off-peak hours only.

•

After a user account is deleted from Active Directory, this option deletes the

corresponding user account from DMM and Show and Share.

•

After a user account is associated to a new first name, last name, or username, this

option overwrites the outdated user account attributes.

Delete

Caution

The Delete option is destructive by design. We advise that you use it sparingly and with great

caution. Among other effects, your deletion of an LDAP bookmark can affect user access to videos

in Show and Share.

Note

Typically, the deletion process takes about 1 minute to finish. However, when there are more than

50,000 users in the Active Directory database, this process might run in the background and take about

30 minutes to finish. In this case, the user interface in DMS-Admin can show that a bookmark was deleted

even though the actual process has not finished. If you observe this behavior, simply allow 30 minutes for

the operation to finish.

1. Attributes that you entered on the Manage Attributes property sheet in DMS-Admin.

Related Topics

•

Manage LDAP Attributes, page 6-26

LDAP Concepts

•

Understand LDAP Attributes, page 6-15

Guidelines for LDAP Filters, page 6-15

User Guide for Cisco Digital Media Manager 5.2.x

OL-15762-03

6-14

Download from Www.Somanuals.com. All Manuals Search And Download.

Chapter 6 Authentication and Federated Identity

Concepts

Understand LDAP Attributes

Ordinarily, DMS-Admin will not import any user account from your Active Directory server when the

value in it is blank for any of these attributes:

•

First Name—This required value might be identical for multiple users.

Last Name—This required value might also be identical for multiple users.

However, you can import and synchronize all of the Active Directory user accounts that match your

filters. You can do this even when some of the user accounts are incomplete because one or more of their

attributes have blank values.

To prevent these undefined attributes from blocking the import of the user accounts they are meant to

describe, you can enter generic values for most attributes in the Values to Use by Default column.

DMS-Admin takes the generic values that you enter, and then inserts them automatically where they

are needed.

Tip

Nonetheless, you cannot enter a default value for the Login User Name attribute. Usernames are unique.

Guidelines for LDAP Filters

•

Use “OU” values to impose rough limits on a filter, page 6-15

Use “memberOf” values to pinpoint a filter more precisely, page 6-16

Use “objectClass” values to match all user records, page 6-16

Use “OU” values to impose rough limits on a filter

•

Never use a filter that defines the user base at the domain level. For example, this filter is

not acceptable.

DC=example,DC=com

•

Instead, use filters that define the user base at a lower level, as this one does.

OU=SanJose,DC=example,DC=com

LDAP returns matched records from all levels within the user base that your filter defines.

Would a filter for “^{OU=SanJose,DC=example,DC=com}” ever include any users from...?

OU=RTP,DC=example,DC=com

No¹

Yes²

OU=Milpitas,OU=SanJose,DC=example,DC=com

OU=Sunnyvale,OU=SanJose,DC=example,DC=com

1. Research Triangle Park, NC, does not have any physical connection to San José, CA.

2. Milpitas, CA and Sunnyvale, CA, are suburbs of San José, CA, which affects them directly and in multiple ways.

User Guide for Cisco Digital Media Manager 5.2.x

OL-15762-03

6-15

Download from Www.Somanuals.com. All Manuals Search And Download.

Chapter 6 Authentication and Federated Identity

Concepts

Use “memberOf” values to pinpoint a filter more precisely

•

But what if you did not want to include any members of Milpitas or Sunnyvale? If your

Active Directory server considered these cities (organizational units) to be subsets of San José, how

could you exclude their members? To do so, you would use the

memberOf

attribute. It stops LDAP from matching records at any lower level than the one you name explicitly.

In this scenario for example, you would use

memberOf=OU=SanJose,DC=example,DC=com

to match only the direct members of the “SanJose” OU.

Use “objectClass” values to match all user records

•

You can define a comprehensive filter that matches all user records.

objectClass=user

Password Concepts

Note

NEW IN CISCO DMS 5.2.3—User passwords in Cisco DMS are no longer case-sensitive.

•

Understand the Effects of a Changed Password in Active Directory, page 6-16

Understand the Effects of a Blank Password in Active Directory, page 6-16

Understand the Effects of a Changed Password in Active Directory

After you change a user password on your Active Directory server, there is no requirement to

resynchronize the affected user account in DMS-Admin.

Understand the Effects of a Blank Password in Active Directory

Even though it is possible in Active Directory to use a blank value for a password, Cisco DMS does

•

not allow it.

•

When you choose LDAP authentication, any user whose Active Directory password is blank is

prevented from logging in to any component of Cisco DMS.

Access is enabled or restored after the password is populated on the Active Directory server.

Understand Authentication Property Sheets for LDAP

The Authentication page contains four tabbed property sheets.

Select

Mode¹

Embedded, LDAP, or (NEW IN CISCO DMS 5.2.3) SSO

Select Mode is by default the only active tab. Your choices on the Select Mode property sheet

determine whether you have access to the other three property sheets.

Define

Filter

LDAP or (NEW IN CISCO DMS 5.2.3) SSO

Your choices on the Define Filter property sheet help you to configure and add a new agreement.

User Guide for Cisco Digital Media Manager 5.2.x

OL-15762-03

6-16

Download from Www.Somanuals.com. All Manuals Search And Download.

Chapter 6 Authentication and Federated Identity

Concepts

Synchronize

Users

LDAP or (NEW IN CISCO DMS 5.2.3) SSO

Your choices on the Synchronize Users property sheet help you to submit a new agreement.

Manage

Attributes

LDAP or (NEW IN CISCO DMS 5.2.3) SSO

1. In most production environments, you can expect to use the Select Mode property sheet only one time.

Federated Identity and Single Sign-on (SSO) Concepts

•

IdP Requirements, page 6-17

Configuration Workflow to Activate Federation (SSO) Mode, page 6-17

Authentication Scenarios for User Sessions in Federation (SSO) Mode, page 6-18

IdP Requirements

NEW IN CISCO DMS 5.2.3—To use federation (SSO) mode in Cisco DMS, you must have access to an IdP

that meets our requirements. Your IdP must:

•

Support SAML 2.0.

Support these two SAML profiles:

–

Web Browser SSO Profile

Enhanced Client or Proxy (ECP) Profile

•

Generate assertions in which the SAML “UID” attribute is mapped to the local portion of an

authenticated user’s username.

Use a digital certificate from a well-known CA (but only if you will use HTTPS).

Configuration Workflow to Activate Federation (SSO) Mode

NEW IN CISCO DMS 5.2.3

1. Configure and set up an Active Directory server.

2. Configure and set up a SAML 2.0-compliant IdP.

Note

When you use a “fresh install” of Cisco DMS 5.2.3 (as opposed to an upgrade), your DMM appliance is configured

to use embedded authentication mode by default. But when you upgrade a DMM server that was already

configured for an earlier Cisco DMS release, it might use either embedded mode or LDAP mode.

3. Obtain a digital certificate from a trusted CA and install it on your IdP.

4. Use DMS-Admin to configure Cisco DMS for federation mode.

5. Export SAML 2.0-compliant metadata from your DMM server and import it into your IdP.

6. Export SAML 2.0-compliant metadata from your IdP and import it into your DMM server.

7. Configure Active Directory exactly as you would in LDAP mode.

8. Click Update to save your work, and then advance to the Synchronize Users property sheet.

User Guide for Cisco Digital Media Manager 5.2.x

OL-15762-03

6-17

Download from Www.Somanuals.com. All Manuals Search And Download.

Chapter 6 Authentication and Federated Identity

Concepts

9. Synchronize DMM with your Active Directory server to populate the DMM user database.

Note

You MUST configure at least one LDAP bookmark.

10. Synchronize users exactly as you would in LDAP mode.

Note

Whenever you change any setting or value on your IdP or any of your SPs, you must reestablish their

pairing to restore mutual trust among them.

11. Click Update to save your work.

Authentication Scenarios for User Sessions in Federation (SSO) Mode

•

SSO Scenario 1 —T rusted + V a lid + Authorized

SSO Scenario 2 —T rusted + V a lid + NOT Authorized

SSO Scenario 3 —N othing Known

SSO Scenario 1—Trusted + Valid + Authorized

NEW IN CISCO DMS 5.2.3

1. A web browser requests access to a protected resource on an SP.

Your federation will not approve or deny this request until it knows more.

2. The SP asks its IdP if the browser is currently authenticated to any valid user account in the CoT.

3. The IdP verifies that:

•

The browser is already connected to an SP elsewhere in the CoT, having authenticated

successfully to a valid user account and having received a SAML “token” or “passport” that

authorizes at least some access.

•

The user account has sufficient permissions to access the protected resource.

4. The IdP acts on the SP’s behalf and redirects the browser immediately to the protected resource.

User Guide for Cisco Digital Media Manager 5.2.x

OL-15762-03

6-18

Download from Www.Somanuals.com. All Manuals Search And Download.

Chapter 6 Authentication and Federated Identity

Concepts

SSO Scenario 2—Trusted + Valid + NOT Authorized

NEW IN CISCO DMS 5.2.3

1. A web browser requests access to a protected resource on an SP.

Your federation will not approve or deny this request until it knows more.

2. The SP asks its IdP if the browser is currently authenticated to any valid user account in the CoT.

3. The IdP verifies that:

•

The browser is already connected to an SP elsewhere in the CoT, having authenticated

successfully to a valid user account and having received a SAML “token” or “passport” that

authorizes at least some access.

•

The user account DOES NOT have sufficient permissions.

4. The IdP redirects the browser to the SP, where an HTTP 403 Forbidden message states that the user is

not authorized to access the protected resource.

SSO Scenario 3—Nothing Known

NEW IN CISCO DMS 5.2.3

1. A web browser requests access to a protected resource on an SP.

Your federation will not approve or deny this request until it knows more.

2. The SP asks its IdP if the browser is currently authenticated to any valid user account in the CoT.

User Guide for Cisco Digital Media Manager 5.2.x

OL-15762-03

6-19

Download from Www.Somanuals.com. All Manuals Search And Download.

Chapter 6 Authentication and Federated Identity

Concepts

3. The IdP reports that:

•

The browser is not yet connected to any SP in the CoT.

The browser is not yet authenticated to any valid user account.

We cannot tell if the browser’s human operator is a valid and authorized user, a valid but confused user,

or an intruder.

4. The SP redirects the browser automatically to an HTTPS login prompt on the IdP, where one of

the following occurs.

•

The browser’s human operator successfully logs in to a valid user account. The IdP attaches a SAML

“token” or “passport” to the browser session, authorizing at least some access. And:

– The user account has permission to access the protected resource. So, the IdP acts on

the SP’s behalf and redirects the browser immediately to the protected resource.

– The user account DOES NOT have permission to access the protected resource. So, the

IdP redirects the browser to the SP, where an HTTP 403 Forbidden message states that the user

is not authorized to access the protected resource.

•

The browser’s human operator fails to log in. So, lacking any proof that this person is authorized,

we block access to every protected resource until the human operator can log in successfully.

Migration Between Authentication Methods

•

Understand Migration (from Either LDAP or SSO) to Embedded, page 6-20

•

Understand Migration (from Embedded) to Either LDAP or SSO, page 6-21

Understand Migration (from Either LDAP or SSO) to Embedded

When you migrate from LDAP or federation mode to embedded authentication mode, you must

explicitly choose whether to keep local copies of the:

•

User accounts that were associated to LDAP filters.

Groups and policies that were associated to LDAP filters.

Note

•

Unless you choose explicitly to keep the local copy of a user, a group, or a policy, we discard the local copy.

Migration from one mode to another takes as long as 1 minute to finish.

User Guide for Cisco Digital Media Manager 5.2.x

OL-15762-03

6-20

Download from Www.Somanuals.com. All Manuals Search And Download.

Chapter 6 Authentication and Federated Identity

Procedures

The result varies according to the combination of your choices.

When You

Keep Local

Copies of

The Result

•

We preserve all local information.

Yes Yes Yes

Yes No No

We overwrite all LDAP-derived user account passwords with

CiscoDMMvp99999. ¹

•

We preserve all local user accounts. However, we overwrite all LDAP-derived

user account passwords with CiscoDMMvp99999. ¹

•

We discard all LDAP-derived groups.

We discard all LDAP-derived policies.

We discard all LDAP-derived user accounts.

We preserve all LDAP-derived groups. However, they are empty.

No Yes Yes

No No No

We preserve all LDAP-derived policies. Although they no longer apply to anyone,

you can reuse them and apply them to any remaining user accounts and any future

user accounts as you see fit.

•

We discard all LDAP-derived users, groups, and policies.

1. This security feature protects your network and user data. If anyone gains unauthorized access to the exported file and tries

to use it, Active Directory rejects the invalid passwords.

Understand Migration (from Embedded) to Either LDAP or SSO

Note

•

Before you migrate from embedded authentication mode to federation mode, you must install a digital certificate

from a trusted CA on your IdP server. Otherwise, you cannot migrate to federation mode at all.

After you migrate from embedded authentication mode to either LDAP mode or federation mode, the locked property sheets

become unlocked. You must use them.

Migration from one mode to another takes as long as 1 minute to finish.

Procedures

•

Export the Root CA X.509 Certificate from Y o ur Active Directory Server, page 6-22

Configure DMM to Trust the Active Directory Root CA, page 6-22

Configure LDAP Settings, page 6-23

Configure Federation Services for SSO, page 6-29

User Guide for Cisco Digital Media Manager 5.2.x

OL-15762-03

6-21

Download from Www.Somanuals.com. All Manuals Search And Download.

Chapter 6 Authentication and Federated Identity

Procedures

Export the Root CA X.509 Certificate from Your Active Directory Server

Procedure

Step 1

Step 2

Step 3

Step 4

Open a web browser on your Active Directory server and connect to http://localhost/certsrv.

Click Download a CA certificate.

Choose the current CA certificate.

Choose DER encoded.

The X.509 certificate that you export must be DER-encoded, and it can be binary or printable (Base64).

However, when you use Base64, the certificate file must include these lines:

-----BEGIN CERTIFICATE-----

-----END CERTIFICATE-----

Step 5

Step 6

Click Download CA certificate.

Save this certificate in a file.

For example, you might call the certificate ADcertificate.cer.

Stop. You have completed this procedure.

Step 7

Configure DMM to Trust the Active Directory Root CA

Procedure

Step 1

Step 2

Choose Administration > Security > Authentication > Select Mode.

Enter the details for your Active Directory server.

Tip

Be sure to use the logical port where your Active Directory server listens for SSL connections. The port

number, by default, is 636.

Step 3

Upload the root CA certificate file that you saved locally.

a. Click Upload, and then click Add.

b. Browse to the file on a local volume.

c. Click the filename and press Enter.

d. Click OK to save your work and dismiss the dialog box.

As prompted, use DMS-Admin to restart Web Services (Tomcat).

The installed certificate cannot take effect until after you restart Tomcat.

Stop. You have completed this procedure.

Step 4

Step 5

User Guide for Cisco Digital Media Manager 5.2.x

OL-15762-03

6-22

Download from Www.Somanuals.com. All Manuals Search And Download.

Chapter 6 Authentication and Federated Identity

Procedures

Choose an Authentication Method

Procedure

Step 1

Step 2

Step 3

Choose Administration > Security > Authentication.

Use elements on the Select Mode property sheet to choose an authentication mode.

Click Update.

Note

Migration from one mode to another takes as long as 1 minute to finish.

The authentication settings that you changed are now in effect.

Stop. You have completed this procedure.

Step 4

What to Do Next

•

OPTIONAL—Did you choose LDAP or SSO?

Proceed to the “Define LDAP Filters” section on page 6-23

•

Configure LDAP Settings

•

Define LDAP Filters, page 6-23

Define LDAP Bookmarks, page 6-24

Define the LDAP Synchronization Schedule, page 6-25

Manage LDAP Attributes, page 6-26

Configure the Settings for Automatic LDAP Synchronization, page 6-27

Derive LDAP Group Membership Dynamically from a Query, page 6-28

Define LDAP Filters

Before You Begin

•

Choose LDAP or federation as your authentication method.

Procedure

Step 1

Step 2

Choose Administration > Security > Authentication.

Click Define Filter.

User Guide for Cisco Digital Media Manager 5.2.x

OL-15762-03

6-23

Download from Www.Somanuals.com. All Manuals Search And Download.

Chapter 6 Authentication and Federated Identity

Procedures

Step 3

Do the following.

a. Use elements on the Define Filter property sheet to define, validate, and add one LDAP filter.

b. Click Update.

c. Repeat this step for each filter to be added.

The authentication settings that you changed are now in effect.

Stop. You have completed this procedure.

Step 4

Related Topics

•

Elements to Define, V a lidate, and Add LDAP Filters, page 6-33

Define LDAP Bookmarks

Before You Begin

•

Choose LDAP or SSO as your authentication method.

Define LDAP filters.

Procedure

Step 1

Step 2

Choose Administration > Security > Synchronize Users > LDAP Bookmarks,

Tip

Is the Synchronize Users tab disabled (dimmed), so that you cannot click it? If so, refresh your browser.

Do any or all of the following.

•

Would you like to import user accounts to Cisco DMS because they correspond to an

Active Directory filter that you will define? If so:

–

Choose the synchronization type for these user accounts.

Specify which default access privileges you will assign to them.

•

Should Cisco DMS synchronize user accounts that correspond to a defined Active Directory filter?

If so, use the synchronization type that you chose.

Would you like to sever your ties to a User Base or Active Directory server? If so:

–

Delete from Cisco DMS all user accounts that correspond to a defined Active Directory filter.

Delete the entry for that filter from DMS-Admin.

•

Would you like to create a new group in DMM?

AND

Populate it automatically with user accounts that correspond to an Active Directory

filter that you defined previously?

If so, delete the entry for that filter from DMS-Admin, and then recreate it while associating it to

the new group.

Step 3

Validate the filter.

User Guide for Cisco Digital Media Manager 5.2.x

OL-15762-03

6-24

Download from Www.Somanuals.com. All Manuals Search And Download.

Chapter 6 Authentication and Federated Identity

Procedures

Step 4

Validate the DMM group name.

•

Group names in DMM can include alphanumeric characters (0–9; a–z; A-Z), hyphens (-),

underscores (_), and periods (.).

•

Spaces are forbidden.

Other forbidden characters include:

~‘!@#$%^&*()+={[}]|\:;”"’'<>?/

Step 5

Step 6

Click Update.

Note

Please wait. Your request might take as long as 1 minute to process.

The authentication settings that you changed are now in effect.

Stop. You have completed this procedure.

What to Do Next

•

OPTIONAL—Would you like to associate a set of imported users with a new group?

Proceed to the “Derive LDAP Group Membership Dynamically from a Query” section on page 6-28.

•

OPTIONAL—Would you like to configure the schedule for synchronization?

Proceed to the “Define the LDAP Synchronization Schedule” section on page 6-25.

Related Topics

•

Define LDAP Filters, page 6-23

Derive LDAP Group Membership Dynamically from a Query, page 6-28

Elements to Use LDAP Bookmarks for Synchronization, page 6-34

Define the LDAP Synchronization Schedule

Before You Begin

•

Choose LDAP or SSO as your authentication method.

Define LDAP filters.

Define LDAP bookmarks.

Procedure

Step 1

Step 2

Choose Administration > Security > Synchronize Users > Scheduling,

Choose between manual synchronization and automatic synchronization.

Note

You will not see any of the elements that Table 6-3 on page 6-34 describes until after you define at least one

filter on the Define Filter property sheet.

User Guide for Cisco Digital Media Manager 5.2.x

OL-15762-03

6-25

Download from Www.Somanuals.com. All Manuals Search And Download.

Chapter 6 Authentication and Federated Identity

Procedures

Step 3

Click Update.

The authentication settings that you changed are now in effect.

Stop. You have completed this procedure.

Step 4

What to Do Next

•

OPTIONAL—Would you like to associate attribute names in DMS-Admin and Active Directory?

If so, proceed to the “Manage LDAP Attributes” section on page 6-26.

OPTIONAL—Should Cisco DMS expect that your Active Directory server uses factory-preset attribute

names? If so, proceed to the “Manage LDAP Attributes” section on page 6-26.

OPTIONAL—Should Cisco DMS expect that your Active Directory server uses custom attribute

names? If so, proceed to the “Manage LDAP Attributes” section on page 6-26.

Related Topics

•

Define LDAP Bookmarks, page 6-24

Elements to Schedule Synchronization, page 6-35

Manage LDAP Attributes

Before You Begin

•

Choose LDAP or SSO as your authentication method.

Define LDAP filters.

Define LDAP bookmarks.

Configure the LDAP synchronization schedule.

Procedure

Step 1

Step 2

Click Administration > Security > Authentication > Manage Attributes.

Tip

Is the Manage Attributes tab disabled (dimmed), so that you cannot click it? If so, refresh your browser.

Use elements on the Manage Attributes property sheet to:

•

Set the associations between DMS-Admin attribute names and their corresponding Active Directory

attribute names.

Use the predefined and typical names for Active Directory attributes (shown in grey text) or edit

those attribute names so they match the names that your Active Directory server uses.

Enter the values to use by default in DMS-Admin when a user account attribute is not defined on

your Active Directory server.

You must enter a value for each mandatory attribute. You cannot enter a value to use by default for user

names, because each user name is unique.

Step 3

Click Update.

The authentication settings that you changed are now in effect.

User Guide for Cisco Digital Media Manager 5.2.x

OL-15762-03

6-26

Download from Www.Somanuals.com. All Manuals Search And Download.

Chapter 6 Authentication and Federated Identity

Procedures

Step 4

Stop. You have completed this procedure.

Related Topics

•

Define the LDAP Synchronization Schedule, page 6-25

Import an IdP Configuration File into DMM, page 6-29

Configure the Settings for Automatic LDAP Synchronization

Procedure

Step 1

Step 2

Click the calendar icon ( ) to choose the start date for synchronization.

Choose the hour and minute when synchronization should begin, and then choose either AM or PM as

the period.

Step 3

From the Repeat Interval list, choose the interval of recurrence:

Interval

Never

Description

Synchronization occurs once and does not recur.

Every Day

Synchronization recurs once every 24 hours. You must set the hour and minute when it

should start.

Every Week Synchronization recurs once every 7 days. You must set the hour and minute when it

should start.

Every

Month

Synchronization recurs once each month. You must set the hour and minute when it

should start.

Custom

Synchronization recurs at an interval of your choosing. You must set the hour and

minute when it should start.

Choose Days, Weeks, or Months as the interval type.

•

Choose a day of the month from 1 to 30 when the interval type is Days.

Choose a day of the week when the interval type is Weeks.

Choose an interval of recurrence from 1 to 6 when the interval type is Months.

Step 4

(Optional)

•

Did you click the Automatic Synchronization radio button?

And should a one-time synchronization start immediately, in addition to the start date and time that

you specified?

If so, check the Synchronize users immediately check box.

Click Update.

Step 5

Step 6

The authentication settings that you changed are now in effect.

Stop. You have completed this procedure.

User Guide for Cisco Digital Media Manager 5.2.x

OL-15762-03

6-27

Download from Www.Somanuals.com. All Manuals Search And Download.

Chapter 6 Authentication and Federated Identity

Procedures

Derive LDAP Group Membership Dynamically from a Query

NEW IN CISCO DMS 5.2.1—You can populate a user group with the returned output from a User Base DN

query. However, a group of this kind differs in important ways from a group that you populate manually.

Note

•

Membership of such groups is dynamic—based on shared characteristics among the group of Active Directory

users who match your query.

We update and clean these groups automatically during synchronization. Their membership will change after

synchronization runs, when the corresponding records in Active Directory show that a user's membership should start

or stop.

•

An imported Active Directory group is always read-only in DMS-Admin. By protecting it, we ensure that it is always correct,

relative to the original and subject to any delay between synchronizations. For this reason, you cannot edit their memberships

rolls manually.

When you try to delete a user from a group of this type, DMS-Admin shows an error message.

Before You Begin

•

Choose LDAP as your authentication method.

Procedure

Step 1

Step 2

Step 3

Step 4

Choose Administration > Security > Authentication.

Click Define Filter,

Use elements on the Define Filter property sheet to define, validate, and add one LDAP filter.

Would you like to add users to a group that exists already? If so, choose that group name from the User

Group (in DMM) list.

Would you like to create and populate an entirely new group? If so, choose Create a New User Group

from the User Group (in DMM) list. Then, use the Group Name field to enter a name for the new group.

Step 5

Step 6

Step 7

Would you like to check your filter’s syntax? If so, click Validate.

Click Update.

Stop. You have completed this procedure.

User Guide for Cisco Digital Media Manager 5.2.x

OL-15762-03

6-28

Download from Www.Somanuals.com. All Manuals Search And Download.

Chapter 6 Authentication and Federated Identity

Procedures

Configure Federation Services for SSO

•

NEW IN CISCO DMS 5.2.3—Export an SP Configuration File from DMM, page 6-29

NEW IN CISCO DMS 5.2.3—Import an IdP Configuration File into DMM, page 6-29

NEW IN CISCO DMS 5.2.3—Bypass External Authentication During Superuser Login, page 6-30

Export an SP Configuration File from DMM

NEW IN CISCO DMS 5.2.3—Before you can use Cisco DMS in federation mode, you must export data from

it in the form of an SP configuration file. Later, you will import this file into your IdP.

Procedure

Step 1

Step 2

Step 3

Step 4

Step 5

Step 6

Make sure that your DMM appliance is running in embedded authentication mode or LDAP mode.

Choose Administration > Security > Authentication.

Check the Federation check box.

Click Export.

Save the exported file to your client PC or laptop computer as dms_sp_config.xml.

Note

See the technical documentation or tutorials for your IdP to understand how it imports SP configuration

files like this one.

Step 7

Stop. You have completed this procedure.

Related Topics

•

Import an IdP Configuration File into DMM

NEW IN CISCO DMS 5.2.3—Before you can use Cisco DMS in federation mode, you must export data from

your IdP in the form of an IdP configuration file. This topic explains how to use the exported file after

you generate and save it.

Before You Begin

•

See the technical documentation or tutorials for your IdP to understand how it exports configuration

files for an SP (such as DMM) to import.

•

Rename the exported IdP configuration file dms_idp_config.xml.

Procedure

Step 1

Step 2

Choose Administration > Security > Authentication.

Click Federation to choose it as your authentication mode.

User Guide for Cisco Digital Media Manager 5.2.x

OL-15762-03

6-29

Download from Www.Somanuals.com. All Manuals Search And Download.

Chapter 6 Authentication and Federated Identity

Procedures

Step 3

Click Import.

Step 4

Step 5

Step 6

Choose and upload the IdP file that you saved previously.

Enter the necessary LDAP information to use your Active Directory server.

Stop. You have completed this procedure.

Related Topics

•

Define LDAP Filters

Export an SP Configuration File from DMM, page 6-29

Bypass External Authentication During Superuser Login

NEW IN CISCO DMS 5.2.3—Your DMM server features a special login form, which rejects every

username except superuser. You use this special form whenever Cisco DMS runs in federation mode

or an error has prevented migration from one authentication mode to another.

Procedure

Step 1

Go to http://<FQDN>:8080/dmsadmin/admin/login.

a. Enter superuser in the Username field.

b. Enter the corresponding password in the Password field.

c. Click Log In.

Step 2

Stop. You have completed this procedure.

Related Topics

•

Federation Mode (SSO) FAQs, page 6-42

User Guide for Cisco Digital Media Manager 5.2.x

OL-15762-03

6-30

Download from Www.Somanuals.com. All Manuals Search And Download.

Chapter 6 Authentication and Federated Identity

Reference

•

Software UI and Field Reference Tables, page 6-31

Sample SP Configuration File from DMM, page 6-37

Sample IdP Configuration Files, page 6-38

FAQs and Troubleshooting, page 6-41

Software UI and Field Reference Tables

•

Elements to Choose and Enable the Authentication Mode, page 6-31

Elements to Define, V a lidate, and Add LDAP Filters, page 6-33

Elements to Use LDAP Bookmarks for Synchronization, page 6-34

Elements to Schedule Synchronization, page 6-35

Elements to Choose and Enable the Authentication Mode

Navigation Path

Administration > Security > Authentication > Select Mode

Table 6-1

Elements for the Authentication Mode

Element

Description

Authentication Mode Area

Embedded

Requires users who log in to DMM or Show and Share to authenticate against a user account

database that is native to DMM. This database is independent of every other type of

authentication that you might use in your network.

LDAP

Automatically deletes all user accounts except superuser. Requires future users to authenticate

against the user account data from your Active Directory server when they log in to DMM or

Show and Share.

Federation

Automatically deletes all user accounts except superuser. Requires future users to authenticate

themselves to your IdP when they log in to DMM or Show and Share.

Federation Mode Elements Area

Last Successfully

Configured IdP

This value becomes populated for the first time after you succeed at least once in importing

configuration metadata into DMM from your IdP.

This element is visible only in federation mode.

IdP Configuration File Provides the means to import configuration metadata that you previously exported from your

IdP and saved to a file. Click Import to browse for the file, which you can then import.

This element is visible only in federation mode.

User Guide for Cisco Digital Media Manager 5.2.x

OL-15762-03

6-31

Download from Www.Somanuals.com. All Manuals Search And Download.

Chapter 6 Authentication and Federated Identity

Reference

Table 6-1

Elements for the Authentication Mode (continued)

Element

Last Configured IdP

Description

While it names an IdP explicitly, this value does not necessarily identify the IdP in current use.

Instead, this value describes only your most recent attempt to import configuration metadata

from an IdP, without regard for whether the attempt failed or succeeded.

This element is visible only in federation mode. It becomes populated for the first time after

you attempt at least once to import IdP metadata.

Tip

Compare this value to the “Last Successfully Configured IdP” value. When they differ, you know that

your latest such attempt actually failed.

(SP Configuration File) Provides the means to export configuration metadata from DMM. Click Export to begin

Export

browsing for a locally mounted drive and folder where you can save the exported config file.

Later, you will import this file into your IdP.

This element is visible only in federation mode.

Enable Authentication Helps you to test whether your federation mode settings are correct and will allow SSO for your

Test

ordinary users.

Check this check box to expose UI elements that are otherwise hidden. Clear this check box to

hide such elements.

Test Username

Enter a username that your IdP already knows. Do not use the “superuser” username. This

element is visible only while the Enable Authentication Test check box is checked.

Test User Password

Enter the password that corresponds to the test username. This element is visible only while

the Enable Authentication Test check box is checked.

LDAP Configuration Area

Anonymous

Enables or disables an anonymous connection between your DMM appliance and your

Active Directory server.

•

An anonymous connection is suitable when you want to see or use public information on

the Active Directory server.

•

In contrast, if you want to see or use privileged information on your Active Directory

server, the server will require you to enter login credentials to prove that you have

sufficient access rights.

In the latter case, your Active Directory server will reject any attempt to log in anonymously.

This check box is available to you only when you choose LDAP mode or federation mode.

Host

Port

Enter the routable IP address or DNS-resolvable hostname for the Active Directory server. This

field is available to you only when you choose LDAP mode or federation mode.

Enter the TCP port number that your Active Directory server uses for communications. This

field is available to you only after you choose LDAP mode or federation mode.

The Active Directory port number by default is:

•

389 for LDAP communications.

636 for LDAPS (Secure LDAP, or LDAP over SSL) and SSO communications.

Administrator DN

Enter the distinguished name of the Active Directory server administrator.

This field is available to you only after you choose LDAP mode or federation mode and

uncheck the Anonymous check box.

Tip

See administrator DN, page 6-3.

User Guide for Cisco Digital Media Manager 5.2.x

OL-15762-03

6-32

Download from Www.Somanuals.com. All Manuals Search And Download.

Chapter 6 Authentication and Federated Identity

Reference

Table 6-1

Elements for the Authentication Mode (continued)

Element

Description

Password

Enter the password that is associated with the Administrator DN.

This field is available to you only after you choose LDAP mode or federation mode and

uncheck the Anonymous check box.

Use SSL Encryption

The check box to enable or disable encrypted sign-on. This check box is available to you only

when you use LDAP mode or federation mode.

Note

Whenever you enable SSL, you must restart Web Services (Tomcat) from AAI. And if your DMM

server is one half of a failover pair, the Tomcat restart will trigger immediate failover.

•

Check the check box to enable encryption.

Uncheck it to disable encryption.

Enabling SSL causes the connections between your DMM appliance and your Active Directory

server to use LDAPS. An LDAPS connection is suitable when you want to prevent untrusted

third parties from reading credentials that the servers exchange.

Active Directory

Certificate File

Helps you to upload the digital certificate that your Active Directory server uses for LDAPS

communications. This field is available to you only while the Use SSL Encryption check box

is checked.

Command Buttons

Update

Cancel

Saves and applies your work on the Authentication Mode property sheet.

Discards your work on the Authentication Mode property sheet and resets all values to their

previous configuration.

Related Topics

•

Elements to Define, V a lidate, and Add LDAP Filters, page 6-33

Elements to Use LDAP Bookmarks for Synchronization, page 6-34

Elements to Define, Validate, and Add LDAP Filters

Navigation Path

Administration > Security > Authentication > Define Filter

Table 6-2

Elements for Filters

Element

Description

Enter a human-readable description for the filter.

Enter the distinguished name of the Active Directory user base that you will search.

User Base DN

User Filter

Enter a user filter to limit the number of matching user accounts to import from the user base

that you specified.

User Guide for Cisco Digital Media Manager 5.2.x

OL-15762-03

6-33

Download from Www.Somanuals.com. All Manuals Search And Download.

Chapter 6 Authentication and Federated Identity

Reference

Table 6-2

Element

Elements for Filters (continued)

Description

User Group (in DMM) Choose or create a user group to associate with the filter. At the very least, the list includes

these options.

•

All Users Group

Create a New User Group

Digital Signage Users

Command Buttons

Add

Adds the filter, exactly as entered, without first validating it.

Validate

Clear

Validates the filter to confirm, before you add it, that it will return meaningful results.

Clears all entries from the Define Filters property sheet.

Related Topics

•

Elements to Choose and Enable the Authentication Mode, page 6-31

Elements to Use LDAP Bookmarks for Synchronization, page 6-34

Elements to Use LDAP Bookmarks for Synchronization

Navigation Path

Administration > Security > Authentication > Synchronize Users

Table 6-3

Elements for Bookmarks

Element

Description

LDAP Bookmarks property sheet

Synchronization

One of the following types.

•

Initial

Update

Overwrite

Delete

Note

When you click Delete on the LDAP Bookmarks sub-tab, we ask you whether to delete groups and

policies. When you choose Yes, we delete all of the following from Cisco DMS.

•

All user accounts that match the filter.

NEW IN CISCO DMS 5.2.1—The particular user group that is associated to the filter.

NEW IN CISCO DMS 5.2.1—All access policies associated to the particular user group.

The deletion process can take as long as 1 minute to finish.

User Guide for Cisco Digital Media Manager 5.2.x

OL-15762-03

6-34

Download from Www.Somanuals.com. All Manuals Search And Download.

Chapter 6 Authentication and Federated Identity

Reference

Table 6-3

Elements for Bookmarks (continued)

Description

Element

Command Buttons

Update

Submits your selections for the type of synchronization and the scope of access that you chose

and configured. Synchronization of the specified type starts immediately.

Cancel

Resets all entries to their previous values on the LDAP Bookmarks property sheet.

•

Discards all changes to the configuration of behaviors for synchronizations.

Discards all changes to the scope of access.

Related Topics

•

Elements to Choose and Enable the Authentication Mode, page 6-31

Elements to Define, V a lidate, and Add LDAP Filters, page 6-33

Configure the Settings for Automatic LDAP Synchronization, page 6-27

Elements to Schedule Synchronization

Navigation Path

Administration > Security > Authentication > Synchronize Users

Elements for Scheduling

Description

Table 6-4

Element

Scheduling property sheet

Synchronization Mode Enables one synchronization mode to receive updated user account information from an

Active Directory server. We support two such modes but they are mutually exclusive.

Whenever you enable one, you disable the other. Click either Manual Synchronization or

Automatic Synchronization.

Command Buttons

Update

Submits your selections for the type of synchronization and the scope of access that you chose

and configured. Synchronization of the specified type starts immediately.

Cancel

Resets all entries to their previous values on the Scheduling property sheet.

•

Discards all changes to the configuration of behaviors for synchronizations.

Discards all changes to the scope of access.

Related Topics

•

Elements to Choose and Enable the Authentication Mode, page 6-31

User Guide for Cisco Digital Media Manager 5.2.x

OL-15762-03

6-35

Download from Www.Somanuals.com. All Manuals Search And Download.

Chapter 6 Authentication and Federated Identity

Reference

•

Elements to Define, V a lidate, and Add LDAP Filters, page 6-33

Elements to Manage Attributes

Navigation Path

Administration > Security > Authentication > Manage Attributes

Table 6-5

Elements for Attributes Management

Element

Description

DMM Attribute Name Values that DMS-Admin uses to describe and identify various attributes that it associates with

each user account. You cannot change the values in this column. They are for your reference

only, to help you enter suitable values (and recognize suitable values when you see them) in

the LDAP Attribute Name column and the Values to Use by Default column.

LDAP Attribute Name Values that your Active Directory server uses—which correspond one-to-one with values in

the DMM Attribute Row column—to describe and identify attributes of each user account. In

its factory-default configuration, DMS-Admin prepopulates all fields in this column with the

most commonplace values that Active Directory servers use for this purpose. When the values

for these attributes differ on your Active Directory server or when you prefer to import objects

that use other Active Directory attributes, you can edit the values in this column.

Values to Use by

Default

Enter text to insert automatically when the value is blank for the corresponding attribute in an

Active Directory user account that you import or synchronize. To ensure that DMS-Admin

imports each valid user account that matches a filter, we recommend that you enter values for

these attributes:

•

First Name

Last Name

For your convenience, you can also enter values to insert automatically when the values are

blank for other attributes—such as Company, Department, or Phone Number—but this

is optional.

Note

You cannot enter a value to use by default as the Login User Name value.

Ignore User Account

Control Flags

NEW IN CISCO DMS 5.2.3—Tells DMM to ignore whether your Active Directory server makes use

of the User Account Control Flags attribute. DMM expects to find this attribute on your

Active Directory server and, when the attribute is not present, authentication fails.

Command Buttons

Reset to Factory Default Returns all values in the LDAP Attribute Name column to the most commonplace values that

Active Directory servers use. If you entered different values manually because the labels for

these attributes differ on your Active Directory server or because you prefer to import user

accounts that use other Active Directory attributes, DMS-Admin deletes what you entered.

Update

Saves and applies your work in the Manage Attributes property sheet.

Related Topics

•