> For the complete documentation index, see [llms.txt](https://ztrust.gitbook.io/livestreamiq/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ztrust.gitbook.io/livestreamiq/readme/4.-administration/4.1.-authentication.md).

# 4.1. Authentication

LiveStreamIQ supports multiple authentication providers, including Azure AD, Google, LinkedIn, GitHub, OAuth2, Facebook, Twitter/X, Keycloak, and ZTrust.

#### 1. ZTrust Configuration

The following steps explain how to integrate ZTrust Authentication with the LivestreamIQ platform.

Step 1: Open Authentication Configuration

![](/files/Il8392wiz3Ie0s8vCsGd)

1. Log in to the LiveStreamIQ Portal.
2. Navigate:  **Administration → Authentication**
3. The Authentication Setup page displays all supported authentication providers.
4. Then, Select **ZTrust** from the Options provided.

Step 2: Add a ZTrust Provider

![](/files/0r3FDbRtKZfBHhtFeRqt)

1. On the ZTrust Providers page, click Add Provider.
2. The ZTrust configuration form will open.

 Step 3: Configure Provider Details

1. Provider Name: Enter a friendly name for the provider.\
   Example:\
                   `ZTrust`\
   \
   This name will be displayed in the authentication settings.
2. ZTrust Domain: Enter your organization's ZTrust domain.\
   Example:\
                  `sso.ztrust.in`\
   \
   This domain is used to connect LiveStreamIQ with your ZTrust tenant.
3. Realm: Specify the realm configured in ZTrust.\
   Example:\
                  `livestreamiq` \
   \
   The realm identifies the authentication context used for users.
4. Client ID: Enter the Client ID generated in the ZTrust application.\
   Example:\
                   `livestreamiq` 
5. Client Secret: Enter the Client Secret provided by ZTrust.\
   Example:\
                  `your-ztrust-secret`\
   \
   Keep this value secure and do not share it publicly.
6. Redirect URI: Provide the callback URL configured in ZTrust.\
   Example:  [`https://sso.ztrust.in/login/oauth2/code/ztrust`](https://sso.ztrust.in/login/oauth2/code/ztrust)\
   \
   Ensure the same Redirect URI is registered in the ZTrust application settings.

 Step 4: Configure Scopes

 Select the required scopes based on your organization's authentication requirements.

1. Common scopes include:

   | Scope           | Description                                |
   | --------------- | ------------------------------------------ |
   | openid          | Required for OpenID Connect authentication |
   | profile         | Access user profile information            |
   | email           | Access user email address                  |
   | offline\_access | Allow refresh token generation             |
   | read:user       | Read user details                          |
   | user:email      | Access user email information              |
2. Recommended Selection:
   1. openid
   2. profile
   3. email

Additional scopes may be enabled depending on your security policies.

![](/files/CZaMG2vqb7UgU4KSsi33)

Step 5: Select Authentication Type

1. From the Auth Type dropdown, select the authentication protocol.\
   Typical options include:
   1. OAuth 2.0
   2. OpenID Connect (OIDC)
2. Recommended:
   1. Select: `OpenID Connect (OIDC)`\
      This provides secure authentication and user identity information.

Step 6: Configure Role Mapping (Optional)

1. Use the Roles Field to specify the token attribute containing user roles.\
   Examples:  `roles` or `realm_access.roles` or `groups`\
   \
   This allows LiveStreamIQ to automatically assign permissions based on roles received from ZTrust.

Step 7: Save Configuration

1. Review all entered values.
2. Click Save Configuration.\
   \
   The provider will be added to the ZTrust Providers list.

Step 8: Enable Authentication

1. After saving:
   1. Return to the Authentication page.
   2. Verify the ZTrust provider status shows as configured.
   3. Enable the provider if required.

Step 9: Test Authentication

![](/files/ZFDzyNlTCff6dftj9948)

1. Open the LiveStreamIQ login page.
2. Select Sign in with ZTrust.
3. Authenticate using a ZTrust user account.
4. Confirm successful login and user profile retrieval.

#### 2. Google configuration

Step 1: Create an OAuth Application in Google

1. Open the Google Cloud Console.
2. Create a new project or select an existing project.
3. Navigate: **APIs & Services → Credentials**
4. Click Create Credentials → OAuth Client ID.
5. Select Web Application.
6. Configure the application details.
   1. Authorized Redirect URI
   2. Add the redirect URL that will be used by LiveStreamIQ.\
      Example: <https://your-app.com/login/oauth2/code/google>
7. Save the configuration.
8. Copy the generated:

   1. Client ID
   2. Client Secret

   \
   These values will be used in LiveStreamIQ.

Step 2: Open Authentication Configuration

1. Log in to the LiveStreamIQ Admin Console.
2. Navigate: **Administration → Authentication**
3. Select Google from the available authentication providers.

Step 3: Configure Provider Details

![](/files/Eqc7VVB1R4kVFfPm50tw)

1. Provider Name: Enter a friendly name for the authentication provider.\
   Example: `Google`\
   \
   This name will be displayed on the login screen.
2. Client ID: Enter the OAuth Client ID generated in Google Cloud Console.\
   Example: `123456789012-abc123xyz.apps.googleusercontent.com`
3. Client Secret: Enter the OAuth Client Secret generated in Google Cloud Console.\
   Example: `GOCSPX-xxxxxxxxxxxxxxxxxxxx`\
   \
   Keep the Client Secret confidential and do not share it publicly.
4. Redirect URL: Enter the callback URL registered in Google Cloud Console.\
   Example: <https://your-app.com/login/oauth2/code/google>\
   \
   The Redirect URL in LiveStreamIQ must exactly match the Authorized Redirect URI configured in Google.

Step 4: Configure Scopes

1. Scopes determine which user information LiveStreamIQ can access.

   1. Recommended Scopes:

      | Scope   | Description                                |
      | ------- | ------------------------------------------ |
      | openid  | Required for OpenID Connect authentication |
      | profile | Access user's profile information          |
      | email   | Access user's email address                |
   2. Optional Scopes:

      | Scope      | Description                  |
      | ---------- | ---------------------------- |
      | read:user  | Detailed profile information |
      | user:email | Email information            |

   Use additional scopes only when required.

Step 5: Select Authentication Type

1. From the Auth Type dropdown, select the authentication protocol.
   1. Recommended Value:
      1. OpenID Connect (OIDC): OIDC is Google's recommended authentication mechanism and   provides identity information along with authentication.

Step 6: Save Configuration

1. Verify all configured values.
2. Click Save Configuration.

The Google provider will be added to the authentication provider list.