ADFS

Discover step-by-step instructions on configuring a connection with ADFS. Learn how to integrate your application with ADFS for secure and streamlined SSO authentication.

Create new Relying Party

1. Access your Windows Server & Open Server Manager
2. Click on "Tools"

---

Access AD FS Management

---

1. Click on "Relying Party Trust"
2. Once "Relying Party Trust" is highlighted, right click on it.
3. Click on "Add Relying Party Trust"

Relying Party Trust Wizard

1. In the Relying Party Trust Wizard select "Claims aware"
2. Then click on "Start"

---

1. You're invited to select the Data Source, select: "Enter data about the relying party manually"
2. Click on "Next"

---

1. Set a Display name
2. Add notes if you wish to
3. Then click "Next"

---

Click on "Download Certificate" button at the right of this wizard

---

1. Now in the Relying Party Trust Wizard click on "Browse"
2. Upload downloaded certificate, then click "Next" TIP 💡 : If the downloaded file doesn't appears in your Files Manager, select "All files *.*" to find the PEM certificate file on your machine

---

1. On the URL Configuration Screen: check "Enable support for the SAML 2.0 Web SSO protocol"
2. Paste "Relying party SAML 2.0 SSO servicer URL" value you find in the right side of this tutorial 👉
3. Paste it into the corresponding field on your ADFS and click "Next"

---

1. Copy "Relying party trust identifier" value you find in the right side of this tutorial 👉
2. Paste it into the corresponding field on your ADFS.
3. Click "Add" and "Next"

---

1. You're now invited to select the Access Policy you want
2. After your choice click "Next"
3. Review all setup in tabs then click "Next"

---

Review your Relying Party Trust settings and click "Next"

---

In the final wizard screen uncheck the checkbox and click on "Close"

Edit Claim Issuance Policy

In your AD FS, right click on your newly created Relying Party then click on "Edit Claim Issuance Policy"

---

In the window that appeared click on "Add Rule..."

---

1. Select "Send LDAP Attributes Claims"
2. "Next"

---

1. In "Claim rule name": Send attributes
2. In "Attribute store": Active directory

---

---

1. In the "Mapping of LDAP attributes" section, please fill out the fields as shown above
2. Click on "Finish"

---

Create a new rule again by clicking on "Add Rule"

---

1. Select "Transform an Incoming Claim"
2. Then "Next"

---

1. In "Claim rule name" 👉 "NameIDPolicy"
2. In "Incoming claim type" 👉 "UPN"

---

1. In "Outgoing claim type" 👉 "Name ID"
2. In "Outgoing name ID format" 👉 "Transient Identifier"
3. Check "Pass through all claim values" and click "OK"

Relying Party Trust Properties

1. Now click on the created Relying Party
2. Then click on "Properties"

---

Open the "Advanced" tab and make sure the algorithm is "SHA-256"

---

1. Now go to the "Signature" Tab
2. Click "Add..."

---

Then pick the PEM certificate that you downloaded earlier

---

1. Now that the certificate is set click on it
2. Click "View..."
3. If the certificate is not installed, install it.

---

1. Now that the certificate is correctly set and installed go to the "Endpoints" Tab
2. Click on "Add SAML..."

---

1. In "Enpoint type" select "SAML Logout"
2. Select "Redirect" as "Binding"

---

1. In "Trusted URL" paste the "Trusted URL" value you find in the right side of this tutorial 👉
2. In "Response URL" paste the "Response URL" value you find in the right side of this tutorial 👉
3. Click "OK"

---

You can edit the "SAML Assertion Consumer Endpoints" to set the item as default (click and "Edit...")

---

1. Click "Apply"
2. Then "Ok" to finish the setup

XML Metadata file

The next step will ask you for the metadata XML file of your ADFS.

In aim to do so, open https://YOUR-ADFS-SERVER/federationmetadata/2007-06/federationmetadata.xml

💡 If this doesn't return any XML, you can check where it is accessible via a Powershell terminal by entering the following command: Get-AdfsEndpoint | Select-Object fullurl

Drop your downloaded XML metadata

Test SSO login

Test SSO login