You are viewing an old version of this page. View the current version.
Compare with Current View Page History
« Previous Version 2 Next »
Configure ADFS relying party
In this step, you should prepare a metadata file first. To perform this, please complete the steps below:
- Navigate to https://instance.example.com/v1/saml/metadata
- Copy the metadata into a new file with an XML extension (for example, ExampleComSSOMetadata.xml)
- Save the file.
To configure ADFS relying party, you need to:
- Log into your ADFS server and open the management console.
- Select Relying Party Trusts.
- Click Add Relying Party Trust on the top right and click Start.
- Select the Import data about the relying party from a file option.
- Specify a display name and type some notes if needed.
- Do not select any encryption certificate.
- Specify user permissions for this relying party. By default, all users are permitted. Click Next.
- Click Next again, and click Close. The new relying party trust appears.
The metadata link looking alike https://{your_instance_url}/v1/saml/metadata can be obtained on every instance with SSO onboard, regardless of any SAML connection existing.
Manual relying party trust creation
To create relying party trust manually, please complete the steps below:
- Log into your ADFS server and open the management console.
- Select Relying Party Trusts.
- Click Add Relying Party Trust on the top right and click Start.
- Specify the Enter data about the relying data manually option.
- Specify a display name and type some notes if needed.
Do not select any encryption certificate.
- Select the Enable support for the SAML 2.0 WebSSO protocol
- Type https://instance.example.com/adfs/fs
- Specify relying parties identifiers
- Specify user permissions for this relying party. By default, all users are permitted. Click Next.
- Click Next again, and click Close. The new relying party trust appears.
Configure ADFS relying party claim rules
To configure ADFS relying party claim rules, please complete the steps below:
- Log into your ADFS server and open the management console.
- Right-click the relying party trust created earlier.
- Select the Edit Claim Issuance Policy item.
- Click Add Rule.
- Select the Send LDAP Attribute as Claims option and click Next.
- Name the claim. for example, Get LDAP Attributes.
- Enter values as listed below:
- Attribute store = Active directory
- LDAP Attribute = E-Mail-Addresses
- Outgoing Claim Type = E-mail Address
- Click Finish.
- Click Add Rules again.
- Select the Transform an Incoming Claim option and click Next.
- Name the claim, for example, Email2Name.
- Set the Incoming claim type equal to the outgoing claim type in the previous rule. For example, Email Address.
- Set the values as listed below:
- Outgoing claim type = Name ID
- Outgoing name ID format = Email
- Choose the Pass through all claim values option.
- Click Finish.
- Click OK to close the window.
Create a SAML logout endpoint
Generally, SAML logout endpoint are created automatically within relying party trust creating. You can create or edit them manually if needed. To perform this, please complete the steps below:
- Log into your ADFS server and open the management console.
- Right-click the relying party trust created earlier.
- Click on the Endpoints tab.
- Click the Add SAML button.
- Enter values as listed below:
- Endpoint type = SAML Logout
- Binding = POST
- Trusted URL = https://instance.example.com/logout
- Click OK.
Create a SAML connection
To configure a SAML connection, please complete the steps below:
- Navigate to Single Sign-On → SAML Definition.
- Click New and fill in the fields
- Click Save or Save and Exit to apply changes.
SAML definition form fields
Field | Mandatory | Description |
---|---|---|
Name | N | SAML connection name |
User field | Y | Specify a field in the User table containing information for user identification. Available options:
|
Active | Select this checkbox to make this connection active or inactive. | |
SAML Server Metadata tab | ||
Metadata URL | Y | Specify the external URL provided by a service provider for authentication. By this address, an XML file containing the federation metadata is located. Generally, in most cases, this file is named federationmetada.xml. Most of catalog services, like Active Directory, provide link to this file via management console. Provide a public link to the file in this field. In our case, the link is https://instance.example.com/federationmetadata/2007-06/federationmetadata.xml |
Metadata | This field contains an external service answer (SAML federation metadata) and is populated automatically by the federationmetadata.xml file content. | |
Additional information tab | ||
This tab contains record service information (who and when has created or updated the record, other information). |
Test configuration
To test configuration, please complete the steps below:
- Navigate to your ADFS portal. For example, https://instance.example.com/auth-sso
- Sign in to your instance. If configurations have been done correctly, you'll be logged automatically.
- Select Logout from the profile menu to test the logout endpoint functionality.
- No labels