Configuring ADFS 3.0 as the Identity Provider
Before you start the configuration process, make sure that the ServiceDesk Plus MSP application is running in the HTTPS mode. Then, configure ServiceDesk Plus MSP as a Relying Party Trust (RPT). This can be done either manually or using the metadata file.
To configure the Relying Party Trust manually
-
Open the ADFS management application.
-
Right-click Relying Party trust and choose Add Relying Party Trust option. The Add Relying Party Trust Wizard opens.
- Choose Claims Aware and click Next.
- Choose Enter data about the relying party manually and click Next.
- Provide a Display Name and add Notes if any.
- Click Next.
- The next window is to upload the encryption certificate. You can skip this step as ServiceDesk Plus MSP does not support encryption of the SAML responses.
- Click Next.
- Select Enable support for SAML 2.0 Web SSO portal checkbox.
- Enter the Assertion Consumer URL of ServiceDesk Plus MSP in the Relying Party SAML 2.0 SSO Service URL field.
- Click Next.
- In Relying Party Trust identifier, enter the Entity ID of ServiceDesk Plus MSP and click Add.
- Click Next.
- Choose Access Control Policy from the list.
- Click Next.
- Click Close. The Edit Claim Insurance Policy for SDP window opens.
- Minimize the window and double-click Relying Party Trust to open its properties.
- In the Signature tab, add the certificate file downloaded from ServiceDesk Plus MSP by clicking the Add button.
- In the Endpoints tab, click Add SAML and choose the Endpoint Type as SAML Logout.
- Enter the Single Logout Service URL of ServiceDesk Plus MSP in the Trusted URL and Response URL fields.
- Click OK.
- Under the Advanced tab, choose the Algorithm used in ServiceDesk Plus MSP from the drop-down.
- Click Apply.
Configuring Relying Party Trust using the metadata file
-
Open the ADFS management application.
-
Right-click Relying Party trust and choose Add Relying Party Trust option. The Add Relying Party Trust Wizard opens.
-
Choose Claims Aware and click Next.
-
Choose Import data about the relying party from a file.
-
Click Browse and upload the SP metadata file.
- Click Next.
- Provide a Display Name for the RPT and click Next.
- Choose Access Control Policy and click Next.
- Click Next.
- Click Close to complete the configuration.
- After configuring ServiceDesk Plus MSP as a Relying Port Trust, the Edit Claim Insurance Policy for SDP window opens.
- Click Add Rule.
- In the Claim Rule template drop-down, choose Transform an Incoming Claim option and click Next.
- Provide a Claim Rule Name.
- Choose Windows Account Name as the Incoming claim type, Name ID for Outgoing claim type, and Transient Identifier for Outgoing Name ID format. Currently, ServiceDesk Plus MSP supports Transient, Persistent, and Email Address as Name ID formats.
- To login using your username and domain, select Transient or Persistent.
- To login using your email address, select EmailAddress.
- Click Finish.
To download the IdP Certificate
-
Go to Services >> Certificates and click the Token-signing certificate.
- Under the Details tab, click Copy to File option. The Certificate Export Wizard opens.
- Choose DER encoded binary X.509 (.CER) and click Next.
- Enter the location to save the file and provide the file name at the end of the URL.
- Click Next. You must upload this certificate in ServiceDesk Plus MSP application to complete the integration
Note:
The login and logout URLs for ADFS 3.0 are as follows:
Login URL: https://yourdomainname/adfs/ls
Logout URL: https://yourdomainname/adfs/ls?SingleSignOut=SingleSignOut
- Click Finish.
You have now configured ServiceDesk Plus MSP as a service provider in ADFS 3.0. Go to the SAML configuration page in ServiceDesk Plus MSP and provide the IdP details to complete the integration.