<p>This section provides instructions on how to setup Microsoft AD FS (Active Directory Federation Services) as a SAML Identity Provider (IdP). Before you setup ADFS, you must first enable SAML SSO in CompanyName, import the IdP Metadata into CompanyName, and export the SP Metadata. You must also Copy or transfer the SP Metadata XML file to your AD FS server.</p> <p>Setting up ADFS involves three steps (the following steps use Windows Server 2012 R2 and ADFS 3.0):</p> <ol> <li>Import the SP Metadata into ADFS</li> </ol> <p>On your ADFS host open the Server Manager tool and select the <strong>AD FS Management</strong> option:</p> <p><img src="/images/adfs-1.png" alt="image"></p> <p>In the AD FS Management window, navigate to Trust Relationships -&gt; Relying Part Trusts and select <strong>Add Relying Party Trust</strong> from the right Actions panel:</p> <p><img src="/images/adfs-2.png" alt="image"></p> <p>Select the SP Metadata XML file that you exported from CompanyName:</p> <p><img src="/images/adfs-3.png" alt="image"></p> <p>Provide a Display Name:</p> <p><img src="/images/adfs-4.png" alt="image"></p> <p>If your organization used Multi-factor Authentication (MFA), you can enable it. Otherwise, leave it disabled:</p> <p><img src="/images/adfs-5.png" alt="image"></p> <p>On the next screen, select <strong>Permit all users to access this relying party</strong>:</p> <p><img src="/images/adfs-6.png" alt="image"></p> <p>Since we imported the SP settings from the Metadata file, simply click next on the <strong>Ready to Add Trust</strong> screen:</p> <p><img src="/images/adfs-7.png" alt="image"></p> <p>Make sure that the <strong>Open the Edit Claim Rules dialog...</strong> option is checked and close the wizard:</p> <p><img src="/images/adfs-8.png" alt="image"></p> <p>Proceed to configure a SAML claim below.</p> <ol start="2"> <li>Setup a SAML Claim Rule for CompanyName</li> </ol> <p>CompanyName requires that the SAML Name ID field contain the email address of the principal. You can enable this by configuring a SAML Claim Rule in ADFS.</p> <p>Click on <strong>Add Rule..</strong> to configure the claim:</p> <p><img src="/images/adfs-9.png" alt="image"></p> <p>Select <strong>Send LDAP Attributes as Claims</strong> and click next:</p> <p><img src="/images/adfs-10.png" alt="image"></p> <p>Enter a name for the claim rule, such as &ldquo;email address&rdquo;. Then select <strong>Active Directory</strong> as the Atribute Store. In the mapping section, select <strong>E-Mail-Addresses</strong> as the LDAP Attribute and <strong>Name ID</strong> as the Outgoing Claim Type.</p> <p><img src="/images/adfs-11.png" alt="image"></p> <p>Click <strong>Finish</strong> to add the claim and then <strong>OK</strong> to exit the Edit Claim Rules dialog.</p> <ol start="3"> <li>Allow SAML signature certificates to be self-signed</li> </ol> <p>In a SAML message exchange, X.509 Certificates with public and private key pairs are used to sign and encrypt the data. Since the keys are exchanged via Metadata and the SAML messages are exchanged over a secure (TLS) connection, there is no benefit in using CA signed certificates for signing.</p> <p>CompanyName generates self-signed certificates for SAML signatures and encryption. You must setup AD FS to not require CA certificates for SAML signing and encryption. You can manage these settings using PowerShell as described below.</p> <p>Check you current settings using the PowerShell command:</p> <pre><code>Get-AdfsRelyingPartyTrust | Select-Object Identifier, SigningCertificateRevocationCheck, EncryptionCertificateRevocationCheck </code></pre> <p>Look for the Identifier <strong><a href="https://www.nirmata.io/security/api">https://www.nirmata.io/security/api</a></strong>.</p> <p><img src="/images/adfs-12.png" alt="image"></p> <p>Use this PowerShell command to disable CA certificate checks for CompanyName:</p> <pre><code>Get-AdfsRelyingPartyTrust -Identifier https://www.nirmata.io/security/api/ | Set-AdfsRelyingPartyTrust -SigningCertificateRevocationCheck None -EncryptionCertificateRevocationCheck None </code></pre> <p><img src="/images/adfs-13.png" alt="image"></p> <p>You should now be able to navigate to your AD FS login page and select CompanyName (CompanyName Cloud Services). This will initiate the SAML SSO exchange and authenticate your users with AD FS.</p> <p><img src="/images/adfs-14.png" alt="image"></p> <p>Alternatively, you can also sign in using your email address at: <a href="https://nirmata.io/">https://nirmata.io/</a>.</p>