Configuring SAML SSO for Active Directory Federation Services (AD FS)
The following guide elaborates on the steps to configure SSO for AD FS with ADSelfService Plus. This enables users to access all AD FS integrated applications by authenticating with ADSelfService Plus.
Prerequisite
- Fetch the AD FS server federation metadata by pasting the following URL in a browser: https://<adfs_fqdn>/FederationMetadata/2007-06/FederationMetadata.xml
ADSelfService Plus (identity provider) configuration steps
- Log in to ADSelfService Plus as an administrator.
- Navigate to Configuration → Self-Service → Password Sync/Single Sign On → Add Application → Custom Application.
- Enter the Application Name, Description, and Domain Name in the respective fields.
- Choose the policy containing the users you wish to provide SSO access to AD FS from the Assign Policies drop-down.
- Select the checkbox Enable SSO using SAML.
- Set Support SSO flow to SP initiated.
- In the Upload Metadata field, upload the file downloaded previously in the prerequisite step.
- Under Provider Settings, enter the following information:
- Select RSA-SHA256 from the RSA SHA Algorithm drop-down.
- Set the SAML Response value to Signed.
- Select the option Exclusive Canonicalization from the Canonicalization Method drop-down.
- Click Advanced in the top-left corner.
![Create custom Applications](https://www.manageengine.com/za/products/self-service-password/images/active-directory-federation-services-screenshot-1.png)
- Under the SAML Assertion Attributes Configuration section, create an attribute and enter the following values:
- Enter the attribute name as “http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn”.
- Choose any relevant value for the Value field.
![Advanced Configuration](https://www.manageengine.com/za/products/self-service-password/images/active-directory-federation-services-screenshot-2.png)
- Click IdP details and select Download IdP Metadata, which will download the metadata file required for later.
![IdP Details](https://www.manageengine.com/za/products/self-service-password/images/active-directory-federation-services-screenshot-3.png)
AD FS (service provider) configuration steps:
Step 1: Adding a new claims provider trust
- Open the AD FS Management console. Navigate to AD FS → Trust Relationships → Claims Provider Trusts.
![AD FS Explorer](https://www.manageengine.com/za/products/self-service-password/images/active-directory-federation-services-screenshot-4.png)
- Click Add Claims Provider Trust in the Actions pane. This will open the Add Claims Provider Trust Wizard. Click Start.
![Add claims ptovider trust wizard](https://www.manageengine.com/za/products/self-service-password/images/active-directory-federation-services-screenshot-5.png)
- In the Select Data Source section, choose the option Import data about the claims provider from a file and upload the metadata file downloaded in Step 11 of the ADSelfService Plus configuration steps.
![Add claims ptovider trust wizard](https://www.manageengine.com/za/products/self-service-password/images/active-directory-federation-services-screenshot-6.png)
- In the Specify Display Name section, enter the desired Display name.
![Add claims ptovider trust wizard](https://www.manageengine.com/za/products/self-service-password/images/active-directory-federation-services-screenshot-7.png)
- Complete the remaining steps in the wizard by retaining the default values for the rest of the fields.
Step 2: Adding claim rules
- Once the claims provider trust configuration is complete, the Claims Rule Editor window opens. Click Add Rule.
![Edit claim rules](https://www.manageengine.com/za/products/self-service-password/images/active-directory-federation-services-screenshot-8.png)
- From the Claim rule template drop-down, select the value Pass Through or Filter an Incoming Claim and click Next.
![Add transform claim rule wizard](https://www.manageengine.com/za/products/self-service-password/images/active-directory-federation-services-screenshot-9.png)
- In the next window, enter a Claim rule name and set any of the supported claim types as the Incoming claim type. For information regarding the supported claim types, click here. Choose the Pass through all claim values radio button. Click Finish to complete adding the claims rule.
![Add transform claim rule wizard](https://www.manageengine.com/za/products/self-service-password/images/active-directory-federation-services-screenshot-10.png)
Step 3: Modify existing relaying party trusts
The existing relaying party trusts need to be modified in order to map the incoming claim to an outgoing claim that will be sent to the relaying party.
- Click Relaying Party Trusts under Trust Relationships. Right-click the desired SSO applications from the list and select Edit Claim Rules. Click Add Rule.
![Relying party trusts](https://www.manageengine.com/za/products/self-service-password/images/active-directory-federation-services-screenshot-11.png)
![Edit claim rules for Salesforce RP](https://www.manageengine.com/za/products/self-service-password/images/active-directory-federation-services-screenshot-12.png)
- In the Add Transform Claim Rule Wizard, choose the option Transform an Incoming Claim from the Claim rule template drop-down and click Next.
![Add transform claim rule wizard](https://www.manageengine.com/za/products/self-service-password/images/active-directory-federation-services-screenshot-13.png)
- Enter “Name ID” in the Claim rule name field and set UPN as the Incoming claim type. Set Name ID as the Outgoing claim type and click OK.
![Edit rule wizard](https://www.manageengine.com/za/products/self-service-password/images/active-directory-federation-services-screenshot-14.png)
To enable SSO for all AD FS integrated applications, repeat Step 3 for all the applications configured in AD FS.
You have now completed configuring ADSelfService Plus as the identity provider for AD FS.
Highlights
Free Active Directory users from attending lengthy help desk calls by allowing them to self-service their password resets/ account unlock tasks. Hassle-free password change for Active Directory users with ADSelfService Plus ‘Change Password’ console.
Get seamless one-click access to 100+ cloud applications. With enterprise single sign-on, users can access all their cloud applications with their Active Directory credentials. Thanks to ADSelfService Plus!
Intimate Active Directory users of their impending password/account expiry by mailing them these password/account expiry notifications.
Synchronize Windows Active Directory user password/account changes across multiple systems, automatically, including Office 365, G Suite, IBM iSeries and more.
Ensure strong user passwords that resist various hacking threats with ADSelfService Plus by enforcing Active Directory users to adhere to compliant passwords via displaying password complexity requirements.
Portal that lets Active Directory users update their latest information and a quick search facility to scout for information about peers by using search keys, like contact number, of the personality being searched.