Assign Category Access via SSO Attributes

Take greater control over content visibility in BrandTV by managing category access through Single Sign-On (SSO) attributes. Using SAML or OIDC authentication, you can restrict access to specific categories based on user attributes, ensuring audiences only see content relevant to them. Categories can also be designated as public, allowing all viewers to access selected content without additional restrictions.

How to Configure

Step 1: Create a Registration Field

Before configuring category permissions, you'll need to create a registration field corresponding to the attribute provided by your SSO provider.

1. Navigate to the Live tab in BrandTV.
2. Open the appropriate project and navigate to edit the registration fields.
3. Create a new registration field corresponding to the SSO attribute you want to use, such as State or Department.

4. Save your registration field.

   

The registration field will be used to map information received from your organization's identity provider.

Step 2: Map Your SSO Attributes

Once your registration field has been created, you'll need to map it to the corresponding attribute from your SSO provider.

1. Navigate to Settings in BrandTV.

2. Open Integrations.

   

3. Locate the Attribute Mapping section for your SSO configuration.
4. Select the registration field you previously created.

5. Map the field to its corresponding SSO attribute.

   

6. Confirm that the connected attribute column reflects the correct mapping.

Your SSO provider, such as Okta or Microsoft Entra ID, is responsible for assigning and maintaining attribute values within individual user profiles.

For example, if a user's profile contains a State attribute with the value "Ohio," that value can be used to determine which BrandTV categories they can access.

Step 3: Configure Category Access

After mapping your SSO attributes, you can configure which categories are available to viewers with specific attribute values.

1. Navigate to your BrandTV Settings > Access

2. Select one of your attributes to add values to

   

3. Add the attribute values you want to use for category access. For example, if the attribute is Country, you would add the values you want as options (USA, France, Spain, Canada, etc.).

   

4. For each attribute value, select the categories or subcategories viewers should be able to access.

   

5. Repeat this process for any additional attribute values.

Your category access selections are automatically saved, so no additional save action is required.

Step 4: Configure Public Categories

In addition to restricting categories through SSO attributes, administrators can designate categories as public.

Public categories are accessible to all viewers of the site, regardless of their SSO attribute values.

To configure public category access:

1. Navigate to your BrandTV Settings > Access Menu

2. When selecting attributes and categories, there will be toggles to set certain categories as public

   

3. Select the categories you want to make publicly accessible.
4. Confirm your selections.

Public categories are particularly useful for displaying general information, company-wide resources, or content intended for audiences who do not have a matching attribute value configured in BrandTV.

Understanding Parent and Subcategory Access

BrandTV supports category permissions across nested categories, allowing you to control access to specific subcategories without granting access to all content within their parent categories.

When a viewer is granted access to a subcategory:

• The parent category becomes visible to support navigation.
• The viewer can access content within the assigned subcategory.
• Other subcategories remain restricted unless the viewer has been granted access through another attribute or permission.

For example, if a viewer is granted access to the "Sales Training" subcategory under "Employee Resources," they can navigate through Employee Resources to reach Sales Training without automatically receiving access to other restricted subcategories.

Understanding Multiple Attribute Permissions

When multiple SSO attributes are configured for category access, BrandTV uses additive permissions.

This means viewers receive access to the combined categories assigned through all matching attribute values, rather than only categories shared between those attributes.

For example:

A viewer whose SSO profile includes both Department = Marketing and State = Ohio will have access to both Marketing Resources and Ohio Regional Content, in addition to any public categories.

BrandTV does not currently support requiring multiple attributes to match simultaneously to grant access.

If your organization requires access based on a specific combination of attributes, such as users who are both in Marketing and located in Ohio, that combination must be represented through a dedicated attribute value provided by your identity provider.

Important Considerations

Keep the following in mind when configuring SSO-based category access:

• Attribute-based permissions only: BrandTV supports access rules based on SSO attributes and values, not SSO groups.
• Exact value matching: Attribute values are case-sensitive and must match the values provided by your identity provider.
• Additive permissions: When multiple attributes match, viewers receive the combined access granted by those attributes.
• Public categories: Categories marked as public are available to all site viewers, including those without matching configured attribute values.
• New categories: Newly created categories must be manually assigned permissions or marked as public.
• User-level visibility: Administrators can manage permissions by attribute, value, and category, but cannot currently view a consolidated list of permissions for an individual user within BrandTV.
• Automatic permission updates: SSO attributes are re-evaluated each time a viewer logs in after logging out.