Solution

Sohonet provided a centralized asset management platform (called Core) to manage assets stored in the customer’s cloud storage repository. Core created a private library for current production assets approved for sharing across studio business teams. The solution enables the Riot Games IT department to manage the user lifecycle from their existing identity management system, including provisioning access and user permissions at a granular level and using that granular capability to meet security requirements for all applications with access to protected intellectual property.

The asset library is accessible to users with different roles, and assets have different levels of visibility depending on the workflow and the user. Following the principle of least privilege, the roles and permissions are narrow in scope to mitigate security concerns. The Riot Games solution has key roles for invited users: an asset manager/uploader, a security gatekeeper (who approves asset requests), a library user (who browses the library and makes requests), as well as regular viewers and high sensitive viewers. Uploaders see only the assets they upload into the application. Library users view the library’s assets (marked with their own unique visual watermark) but must submit a download request for local access to identified assets. The security gatekeepers, primarily members of a content security group, either approve or deny download requests.

Prior to the Riot Games deployment, the standard Sohonet Core solution already had SAML and SSO support, but a key element of the Riot Games implementation was adding support for the SCIM (System for Cross-domain Identity Management) protocol. With SCIM support, the solution allows Riot Games IT personnel to:

1. Centralize the provisioning of users through their existing IDP and push or “post” those changes to Core’s user management before the user logs in to Core.
2. Assign user permissions for the Core application at the time of user creation before the user even logs into Core.
3. Update or “patch” user permissions once (or delete/deactivate a user) and have those changes flow across all applications, including Core.

Initially, Riot Games evaluated using Sohonet Core SSO without SCIM support. The advantages of standalone SSO include reducing the complexity of managing multiple identities per user and, on a practical level, meeting IDP security requirements by associating user accounts via email address. When the user logs into Core for the first time, the established policy would assign a no-permissions user role. The production or project owner would then assign the user a defined role by submitting an internal change request to the IT team to make the changes manually. The key disadvantage of SSO without SCIM was the need for the product and project owners to manage the user roles on the application end. If the project was onboarding large numbers of users (for a new production, for example), scalability would become an issue since onboarding could not be centralized, and managing the application was only one of the numerous responsibilities of the project owner. If 100 users were added to a project, and each user needed 5 permissions, the process would require hundreds of unique manual changes and manual notifications to each user of their permission changes. Adding SCIM to Core dramatically simplified and expedited the bulk provisioning of permissions when a new group of users is added to the system and bulk decommissioning when users are offboarded. When a new project is set up in Core, the provisioning of users begins with an admin request, and the program team onboards and assigns roles to all identified users automatically by relying on security group membership within the IDP, a process that scales much more easily. SCIM is used to provision accounts and permissions, but not to authenticate access requests. Authentication happens in real time via SAML. SCIM determines permissions based on IT-defined roles in the IDP, as determined by the owner and IT team together. User access can be revoked by the IT team if central control is needed or if the production teams are not available. As a production asset library available to the larger Riot Games studio, Core has users from marketing, creative services, and other teams that request access to the library. As soon as IT adds those users to pre-determined security groups in the IDP, the Core application appears automatically in the Okta tool suite of each user’s individual dashboard. As users leave the organization or no longer require access, the IT group can remove their product access quickly as part of the centralized offboarding process, and those changes will flow through to Core via SCIM.

Architecture

The key elements of the Core solution implemented for Riot Games include:

1. A cloud-based centralized location for storage, packaging, and distribution of all assets.
   As a SaaS solution for production and digital asset management, Core includes modules for AWS S3 storage, AWS EC2 for compute, elastic search, redistribution, package management tools, and media handling of video, audio, stills, documents, and metadata.
2. An asset management system in the cloud that enables multiple applications to interact with the assets in the centralized cloud-based storage.
   The Core application has backend APIs and a front-end UI for managing, collating, packaging, messaging, emailing, sending, and tracking activities by each internal and external customer. All aspects of the solution are hosted at AWS and offered as a managed service.
3. A granular identity and permissions management system implementing both SAML and SCIM is used to configure employees’ roles and access permissions. The roles, together with role-based access control (RBAC), enable implementation of zero trust security policies.
   Core includes a centralized IDP database that allows for an unlimited number of roles and permissions via RBAC policy, allowing multiple users to have the same permission sets based on title and role within their organizational IDP, or alternatively, the same user to be in multiple security groups and have different sets of rights across different applications. In addition, more granular access controls could be set for individuals as needed. SAML is integrated between the Core IDP and Riot Games IDP for authentication and implements just-in-time user creation when that user is authenticated via SSO.

The Riot Games solution also implements SCIM to allow for proactive user creation and RBAC configuration via the SCIM updates, which are stored in the Core IDP. If a user attempts to sign in to Core via enterprise SSO for the first time and does not already have a Core account, the user account is created upon successful authentication. If that user’s access to applications has already been provisioned via SCIM, rights and permissions are provided upon authentication, and the corresponding RBAC permissions also are provided. The addition of the SCIM API allows user provisioning and administrative changes in Riot Games IDP to be carried out by Riot Games IT and automatically pushed to Core, including allowing users to be deprovisioned and even removed from the system remotely. The user data provided in the SCIM calls is mapped to user data in Core, including mapping user “groups” to “roles” within Core.

The solution enables the Riot Games IT team to define multiple security groups with different sets of permissions associated with each group. Those security groups are then mapped to a granular set of application permissions identified in the Core solution.

The Core solution is architected to offer a set of zero trust options to customers as an initial default. It then offers any number of additional options for automated provisioning through configuration of roles and mappings. In the case of Riot Games, the mappings between the options available in Core and the customer-defined security groups enable the Riot Games IT team to choose among the options to implement its own internal security requirements.

Benefits

Core provides Riot Games with a single source of truth for all categories of assets, from managing stock footage and reusable asset elements to capturing production assets for decision-making, historical reference, and reuse across business teams and future projects. It delivers a centralized environment for search, redistribution management, package management, and media handling of video, audio, stills, documents, and metadata. Uploading is easy so that users can share asset libraries across divisions, teams, or productions. Teams also can organize and tag key assets, enhancing searchability, findability, and reuse.

The Core application is hosted in the cloud alongside the Riot Games AWS cloud storage solution, minimizing the need to move metadata or assets into or out of the cloud.

Assets are protected through controlled access and customizable capabilities for visible and forensic watermarking across web and mobile consumption. Core leverage’s modern identity management practices and policies for controlled access. It enables single sign-on across domains, companies, social accounts, and Enterprise IDPs. The integration of single sign-on, coupled with Enterprise tools like SAML and SCIM, allows the centralized Riot Games IT team to ensure maximum protection for content at rest and when sharing.

The Sohonet Core solution gives Riot Games a granular set of options for identity and access management, both for SSO and for user provisioning using the new SCIM protocol support. These include:

1. Multiple levels of default security to choose from:

   a fully trusted,

   b hybrid,

   c SSO only with no provisioning.

2. More granular policy-based access control options that allow the IT department to assign user-level or group-level application permissions or a solution that implements user authentication only and shifts access to deep application-based rights management.

SCIM support in the Core solution enables centralized provisioning of user permissions, allowing the Riot Games IT team to scale onboarding and offboarding to meet the demands of hiring for new projects and productions. It allows Riot Games to choose among different options in the authentication process and the provisioning of user permissions across applications. If needed, it lets the centralized IT team revoke user access across applications or for specific assets or capabilities.

The IT team also can leverage its existing SSO solution without recreating users. It can add user identity fields from the IDP side, alleviating the need for the product owner to apply these changes within Core manually. SCIM support also provides the option to configure RBAC managed access using zero trust security policies, enabling the Riot Games IT department to manage both identity and security aspects of the user lifecycle from their existing identity management system.