ADFS

Follow the steps documented below to integrate your Org and ADFS (Active Directory Federation Services) for Single Sign On (SSO).

Important
Only users with "Organization Admin" privileges can configure SSO in the Web Console.

Step 1: Create IdP

• Login into the Web Console as an Organization Admin
• Click on System and Identity Providers
• Click on New Identity Provider
• Provide a name, select Custom from the IdP Type drop down
• Enter the Domain for which you would like to enable SSO

Important
Within an org, the domain of an IdP cannot be used for another IdP. A domain existing in an org can be used in multiple orgs (for one IdP in each org)

• Enter the valid Admin Email of the domain above to use for validating the ownership of the domain
• Optionally, toggle Encryption if you wish to send/receive encrypted SAML assertions
• Provide a name for the Group Attribute Name
• Optionally, toggle Include Authentication Context if you wish to send/receive auth context information in assertion
• Click on Save & Continue

Important
Encrypting SAML assertions is optional because privacy is already provided at the transport layer using HTTPS. Encrypted assertions provide an additional layer of security on top ensuring that only the SP (Org) can decrypt the SAML assertion.

Step 2: View SP Details

The IdP configuration wizard will display critical information that you need to copy/paste into your ADFS Relying Party Trust configuration. Provide the following information to your ADFS administrator.

• Assertion Consumer Service (ACS) URL
• SP Entity ID
• Name ID Format
• Download the Encryption Certificate (if encryption enabled)
• Group Attribute Statement Name
• Consumer Binding
• Click on Save & Continue

Step 3: Specify IdP Metadata

• Download the ADFS IdP Metadata file from your ADFS metadata URL https:///FederationMetadata/2007-06/FederationMetadata.xml

• In the Metadata configuration page, choose IdP Metadata File option.

• Use Upload button to upload the ADFS IdP Metadata file downloaded above

• Click on Save & Exit to finish the IdP configuration

• Once this process is complete, you can view details about the IdP configuration on the Identity Provider page.

• You can also edit and update the configuration if required.

Step 4: Verify Domain for IdP Integration

• The owner of the admin email to validate the IdP domain in Step 1 should receive an email from the platform where subject contains Verify domain for IDP in organization by name

• Click on the EMAIL VERIFICATION LINK provided in the email to verify the domain

• Once the domain is verified, you can confirm on the Identity Provider page the status of your ADFS IdP

Step 5: Create Relying Party Trust in ADFS

• Open AD FS Management tool as an Administrator

• Select Relying Party Trusts and click Actions > Add Relying Party Trust

• In Add Relying Party Trust Wizard windows, select Claim aware and click Start

• In Select Data Source windows, select Enter data about the relying party manually and click Next

• In Specify Display Name windows, enter the Display name and click Next

• (Optional) In Configure Certificate windows, click Browse and select the Encryption Certificate (if encryption enabled) downloaded in Step 2 then click Next

• In Configure URL windows, select Enable support for the SAML 2.0 WebSSO protocol and enter the Assertion Consumer Service (ACS) URL from the SP configuration in Step 2 to the Relying party SAML 2.0 SSO service URL text field and click Next

• In Configure Identifiers windows, enter the SP Entity ID from the SP configuration in Step 2 to the Relying party trust identifier text field, click Add and click Next

• In Choose Access Control Policy windows, select your desired access control policy for the relying party for example Permit everyone or Permit specific group and add the AD Groups to access to this relying party trust, then click Next

• In Ready To Add Trust windows, verify the relying trust information and click Next

• In Finish windows, select Configure claims issuance policy for this application and click Close

Step 6: Add Claims For Relying Party Trust

• Select the newly created relying party trust and click Actions > Edit Claim Issuance Policy to configure claims

• In Issuance Transform Rules windows, click Add Rule to add the LDAP attribute claim rule

• In Add Transform Claim Rule Wizard > Choose Rule Type windows, select Send LDAP Attributes as Claims in the Claim rule template and click Next

• In Configure Claim Rule windows:

  • Enter Claim rule name,
  • Select Active Directory for Attribute store
  • Select LDAP Attribute E-Mail-Addresses (or User-Principal-Name if email is not configured for the user) to map as Outgoing Claim Type E-Mail Address
  • Select LDAP Attribute Token-Groups - Unqualified Names to map as Outgoing Claim Type Group
  • Then click Finish to create the LDAP attribute claim rule

• In Issuance Transform Rules windows, click Add Rule to add the transform an incoming claim rule for NameID

• In Add Transform Claim Rule Wizard > Choose Rule Type windows, select Transform an Incoming Claim in the Claim rule template and click Next

• In Configure Claim Rule windows:

  • Enter Claim rule name,
  • Select E-Mail Address for Incoming claim type
  • Select Name ID for Outgoing claim type
  • Select Email for Outgoing name ID format
  • Select Pass through all claim values
  • Then click Finish to create the transform an incoming claim rule for NameID

• In Issuance Transform Rules windows, click Add Rule to add the transform an incoming claim rule for Group Attribute

• In Configure Claim Rule windows:

  • Enter Claim rule name,
  • Select Group for Incoming claim type
  • Enter the value of Group Attribute Statement Name from Step 2 for Outgoing claim type
  • Select Pass through all claim values
  • Then click Finish to create the transform an incoming claim rule for Group Attribute

• Then click Apply and OK to finish configuring the Claim Issuance Policy for the relying party trust

Step 7: Groups Configuration In Web Console

Identical named groups with the Active Directory group names need to be created in your Org. Ensure that these groups are mapped to the appropriate Projects with the correct privileges. In the example below, the Group "OrgAdminUsers" is configured as an "Organization Admin" with access to all Projects.

It is important to emphasize that because of SSO via ADFS, user lifecycle management can be completely offloaded to the IdP. In the example below, note that there is no Local Users managed in the "OrgAdminUsers" group but there are IDP Users because they are all managed in ADFS.

• No Local Users in the "OrgAdminUsers"

• IDP Users in the "OrgAdminUsers"

Recap

Congratulations! You have successfully enabled SSO using ADFS. You should be able to login to the Web Console using your ADFS credentials.